skysight-inc/HackerNews huggingface dataset:
I'm quoting from the graph in the article. The numbers are also meant to be "on the order of", since the graph only provides that level of detail - so, for example, 1ns really means "1-9ns".

I believe that they are using fairly best-case latency numbers, under the assumption that the memory accesses are close to sequential. For random memory accesses, as you note, the latencies are higher. Unfortunately the article doesn't go into detail on what Optane's worst-case latencies are, nor what the latencies will be like in a real functional system (mostly because Intel has only early prototypes to show).
In the film given by link below, they say Telegram team has been informed, does that mean that it has been patched?

http://www.sadghaf.com/en/2016/06/13/a-report-about-a-vulner...
> Famously missing, but not the hardest thing to add considering all the features above: Compression (which HFS+ supports!)

HFS+ supports compression, so compression is not a new feature, so it's not on the New Features page. No problem!
You can still hack open source though. Some of the highest profile security projects like openssl get hacked. Sometimes it just takes a simple misconfiguration to get hacked, like with Debian a few years ago.

The point is, computers provide a single point of failure. Bribing enough of a country's electoral officials to shift a vote without being detected is immensely more difficult in comparison to finding a zero-day in some voting software.

The only guarantee that open source provides, is that we'll probably find the bug eventually. A malicious state actor that wants to influence an election has absolutely no incentive to let people know that they've found a vulnerability with any sense of alacrity.
What's the return on investment on that? A huge undertaking, bring features many people do not care about, and the only benefit is that the few people who do use those new features can have it the instant they install the OS rather than after they type `brew install bash`.
"Buzzing" here meaning vibrating -- the iPads don't have vibrating notifications at all, or the required vibrating mechanism.
Just a few clarifications:

* Olm isn't a replacement for 'Signal protocol' - it's just an independent (Apache license) implementation of the same 'double ratchet' cryptographic ratchet that Signal protocol uses under the hood for generating message keys.

* Megolm provides the higher layer semantics for using Olm for group conversations in Matrix, and diverges significantly from Signal Protocol as far as I know.

* There's already an experimental FDroid ready build of Vector Android (following the HN discussion on Friday) at https://matrix.org/jenkins/job/VectorAndroidDevelop/lastSucc... - feedback welcome on just how badly the polling-based push mechanism performs on your hardware & network. We're looking at alternative push mechanisms like microG - or just using a more efficient push transport for Matrix to provide notifs.
The Sun acquisition was announced in 2009 and closed in 2010. It may have been related, but I have my own suspicions about about what caused Apple to jettison their port.
I swear, I must be the only person on the planet satisfied with the current state of systemd and GNOME 3. Fedora 23 is my main workstation OS and I have the least amount of friction getting my work done on it compared to either Windows or macOS these days. Then again, I mostly spend my day in IntelliJ, DataGrip, PyCharm, Firefox, a terminal, and a Windows VM for when I'm forced to open Visual Studio.
Agreed, SAML to JWT is an excellent comparison.

But IMO it is fair to say you can't invalidate JWTs.

More precisely, if you want the ability to invalidate individual JWTs (oops, John's been hacked), then you'll need some kind of per-request check against an authorization server. And if you're doing that, why bother with JWTs in the first place, rather than pack information into the token you might as well pull it from the auth server.

But there are several use cases where you want to - and can easily - invalidate an entire group of JWTs.

For example, we have multi-tenant apps, and it could be you want to invalidate all the JWTs for a single tenant (oops, Fred's Fruit Barn has been hacked). That can be done in different ways, the simplest being that all JWTs issued prior to some date are invalidated.
Turn off iMessage or tell your friends. Or get over it because it's just a silly message?
I'm saying don't play both sides of the coin, an ad hominem attack and then acting like someone else is a bully.
The crucial point is that XSS vulnerabilities are an application level issue. If you have an XSS vulnerability, your application is broken. Good development practices prevent XSS vulnerabilities.

Your application does not have a CSRF vulnerability; HTTP cookies have a CSRF vulnerability. Your application may depend on HTTP cookies, which exposes this vulnerability through your application. The so-called "CSRF protection" is a hack that patches a protocol vulnerability at the application level.
I didn't see in the article, how does the TV become infected? I presume that users of "smart TVs" are mostly using built-in apps for Netflix, Hulu, etc; is there some existing vulnerability that allows this to connect to the TV over the network and exploit it? Or does it require the victim to access website from the TV's browser? (Do smart TVs have browsers?) Or install an app on the TV?
It would be a strange kind of NIH that excluded ZFS but welcomed HAMMER...
https://developer.apple.com/videos/play/wwdc2016/102/

Not available yet, but when it is, it will be at this link.
That was pretty good, except for the part about the DOM as we know it today. HTML and CSS have no place in mobile, VR, or AR.
L’Oreal Voluminous Million Lashes Mascara
You are talking about two different things. One is the latency of data from main memory to the gpu memory and the other is whatever video game metric you are using.
Um, I don't think there is much legitimacy of elections right now. How the fuck did Trump buy his way into the Republican party for one? Do I really think my vote counts right now?

"Online voting could threaten the fundamental legitimacy of elections?"

The author does have some valid points, I just thought it was funny that some people think our elections are legitimate.
I know you are missing your deadlines, but there could be a simple reason there: bad estimates. Who creates the estimates and where are you in that process?

One thing I did when I felt I was stagnating was doing Lunch-And-Learns. I lead a few and for each one, I would research a topic and then teach it during the lunch.

Lastly, don't waste time. Go home and read and program. Go to meetups relating to the topics you are curious about. It's not easy after a long, frustrating, and possibly demoralizing day (especially when missing estimates), but watching online videos will only do so much for you.
Can you not do that? In my experience (including a test just now), speaking that phrase in a natural cadence (no weird pauses) is recognized perfectly.
> It also opens some interesting use cases such as micro-payments between individuals. For example, paying a buddy back for your part of lunch or paying someone in-person for a purchase from Craigslist.

Unless Apple plans on opening a bank, the limiting factor here is still that you/your buddy will be taking a haircut on the credit card processing fees.

Apple Pay doesn't replace the card network, and the card networks are NOT interested in being structured to be micropayment friendly.
different licensing and HAMMER demands significantly less memory
Rant: the issue with gtk is its deeply intertwined with glib and glib is a mess of code that does mostly what standard C and POSIX (stdint, threading, etc) does but in its own buggy way.
Xyrlo Network: the Facebook killer
you can use messenger with just your phone number and no account. you dont need a facebook account.
Well Fedora is basically systemd central, so no surprises there. Frankly if it continues the way it has, every distro becomes Fedora with the serial numbers filed off...
All of your favorite social media functions in one place. Unlimited friends list, news feed, photo share, video channels, marketplace, Snap Up, chat, blogs, forums, and much more!
I agree with some of the arguments against online voting. However, it isn't really realistic to do re-counts right now, nor do people do them regularly. If the people doing the counting are bought then that is an issue too.

Both ways suck right now.

One thing that I would like to see is an open source, standardized system though.

There was/is an effort towards this right now.

http://www.openvotingconsortium.org/our_solution

Stops Secrecy in Vote Tabulation: OVC has a team of scientists ready to program computer software for voting machines and electoral tabulation that would be publicly owned or open source. Open source software could be checked by any party or group by hiring a capable computer programmer.

Provides Paper Trail: The OVC recommended procedure for tabulating elections relies on a paper ballot that is then fed through a scanner into a locked ballot box so that all originals are saved in case of the need for a recount or audit (See Sample Ballot).

Scientifically Verifiable: In addition to open source voting machine and tabulation software, the Open Voting Consortium is also working on a database checklist for standard practices in vote tabulation that would assure transparency and accountability. Some aspects of the OVC concept will soon be enfolded into California legislation.

Saves Money: Typical voting machines cost between $2,000 and $3,000, but OVC open source software could be run on any personal computer (PC) and ballots could be printed on a normal printer. OVC envisions PCs with tamper-proof cases as the new voting terminals at a savings of hundreds or thousands of dollars per terminal.(See page on OVC Cost Analysis).

https://www.youtube.com/watch?v=q8CSKdMTARY OVC at LinuxWorld 2008
Yeah, I wouldn't do that, that graph is hardly accurate. 9ns won't get you a L3 cache hit on most skylake chips, nevermind main memory.

For sequential access giving a latency number doesn't make sense - you need to talk throughput. You can get upwards of 20gb/s with a single core for DRAM. Here you're at least bounded by the 4x PCI interface (more likely the Optane device) so maybe 3GB/s if you're feeling generous.
Thanks for posting this. I'm pretty sure I have this as well. Numbness in ring finger, sometimes waking with numbness in the middle of the night. I tick about all the boxes for symptoms as well - bench press, bad sleeping position, bad posture at desk.
I hit the database on requests - I keep their identity in the JWT but not their permissions. And if they're hitting a protected route (the only time their identity is necessary anyways) you best be sure I'm checking their canonical permissions.
Are HR Managers Scared of Social Media?
My approach to achieve what you describe:

https://roamingaroundatrandom.wordpress.com/2014/06/16/an-mp...

It is based on multiparty computation, and individual smartcards for the voters (the simplest secure solution).
http://www.openvotingconsortium.org/our_solution

Stops Secrecy in Vote Tabulation: OVC has a team of scientists ready to program computer software for voting machines and electoral tabulation that would be publicly owned or open source. Open source software could be checked by any party or group by hiring a capable computer programmer.

Provides Paper Trail: The OVC recommended procedure for tabulating elections relies on a paper ballot that is then fed through a scanner into a locked ballot box so that all originals are saved in case of the need for a recount or audit (See Sample Ballot).

Scientifically Verifiable: In addition to open source voting machine and tabulation software, the Open Voting Consortium is also working on a database checklist for standard practices in vote tabulation that would assure transparency and accountability. Some aspects of the OVC concept will soon be enfolded into California legislation.

Saves Money: Typical voting machines cost between $2,000 and $3,000, but OVC open source software could be run on any personal computer (PC) and ballots could be printed on a normal printer. OVC envisions PCs with tamper-proof cases as the new voting terminals at a savings of hundreds or thousands of dollars per terminal.(See page on OVC Cost Analysis).

https://www.youtube.com/watch?v=q8CSKdMTARY OVC at LinuxWorld 2008
My main use of 3d touch is switching apps. That combined with swiping from left eliminates having to reach down to the home button or up to the back button when using the phone one handed.
Are they not his householders?
WWDC is a conference for developers, but Apple's developers are almost all B2C developers, so the keynote has a specific purpose related to that.

The keynote is basically there to prove to Apple's B2C developers that the "Apple platform" will still be a viable market to sell to for the next year, such that it's worth investing time into to learn all their proprietary platform stuff at the very same conference.

Apple proves their market-viability going forward, by demonstrating all the consumer-facing features that will attract consumers to their devices, where they can then spend money on the B2C developers' apps.

This is also why they screen ads: they're showing the developers their strategy for attracting customers, to buoy up their faith in Apple's market strategy. Apple creating impressive ad copy for their platform directly affects your bottom line as an Apple B2C app dev—so you want to see that they've done it.

---

Note that all this stands in stark contrast to Microsoft's strategy: they love their developers too, but those mainly consist of B2B developers. And you don't win over B2B devs by proving that your platform will attract home users. You win over B2B devs by showing all the Enterprise-y features which your platform will use to guarantee the Enterprise-y deployments the B2B devs sell to; and how it will easily integrate with everything customers already have, such that there won't be an "incompatible" ecosystem of boxen serving some purpose that grows on its own rather than being absorbed into a larger Active Directory domain.

This is, for example, why Windows Server 2016 is all about virtualization: the latest incompatible-cluster tumor growing in the middle of what are otherwise Microsoft shop is private "virtual cloud" infrastructure using VMWare/Citrix/RedHat VM host appliances. If Windows can't integrate with those, acting as their peer or manager or SAN or whatever, then those machines will take over the datacenter and Windows will just become the thing being run in a VM on them.)
I got my first mac product (mbp) a few months ago, I've dabbled in OSX development but still feel guilty for not trying iOS dev yet, despite not even owning an iPhone.
Uh, at Amazon, junior devs go for around $120 if they don't negotiate well. Interns, last I checked, were close to $80.

If you fold in the TCO (benefits, computer / chair / licenses, etc.) for a senior engineer, the $350 isn't too far off.
To be honest, like all very large organisations, I suspect there are many different points of view within Google. For example, Google is slowly working on End-to-End [1].

People tend to expect that businesses run to the lowest common denominator: if it is profitable, then they will do it. This is demonstrably false, though. Most companies avoid the most egregious crimes in our society, and others actually take moral stands on various issues (Lush comes to mind [2]). But of course, no matter what, it's always going to be a nuanced issue (see the comments in the second link to see some people's negative reactions).

Somewhat like Lush, Google has potential to improve the situation and position itself as "the least bad" option. The reality of the situation is that while privacy is very important, almost nobody wants to be completely private. They want to advertise things about themselves -- even to the whole world (see Facebook). Possibly they even want to lie about themselves, but this is still compatible with selling them things to help them sustain their fantasy.

From the perspective of targeting ads, it seems to me to be much more effective to target the "public persona" that people wish others to see rather than the true private person. Building better tools that allow someone to say, "This is how I wish the world to see me" is much, much better than trolling through their personal information and patching up a profile that nobody wishes to expose. And for the few people who wish to be an informational black hole? You weren't going to sell them anything anyway.

P.S. I understand that Google and others have a very long way to go to make this kind of thing a reality. It's just that I don't see it as being antithetical to their business goals.

[1] - https://github.com/google/end-to-end
[2] - https://uk.lush.com/article/lush-ethical-company
> Myself I practiced the piano very deliberately in my late twenties and it didn't lead to improvement.

You had a teacher who provided a lesson plan and guidance, until such time as you could follow the plan on your own and self-correct mistakes? As another element, were you constantly pushed to do things that were just out of your reach? His claim is that 10,000 hours of practice/learning structured in that way would make you an expert piano player. Somehow, I suspect that if you hit 90% of his requirements, he'd "no true Scotsman" you and say that it wasn't "real" deliberate practice.

Personally, I'm dubious about Ericsson's claims too. Some people have more limitations than others do, either physical or mental. Plasticity has its limits.
Mac Oh Ess, like iOS, tvOS, and watchOS.
The fact that people are even able to write about a decentralized financial entity with emergent behavior in the first place says something, too.
Buying an abnormally large amount of short dated, out-of-the-money options is a textbook (and extremely rookie) insider trading move.
Somewhat related to this issue, and yet another potential security issue. Like in a cache, the data in a stateless token will eventually 'go stale', and no longer reflect the latest version of the data in your database.

This can mean that a token contains some outdated information like an old website URL that somebody changed in their profile - but more seriously, it can also mean somebody has a token with a role of admin, even though you've just revoked their admin role.

Umm, if you are storing the roles of a user in a JWT token, I think you are doing things wrong. The point of the JWT token is not to store ALL information of a user. It's simply a way of identifying the user (their ID) and potentially offering an expiration on the token.

Personally, I use tokens to make authenticated API calls but the API still verifies that the user has the required roles to take the specified action. You can then request user data when they login at the same time the token is issued to reduce request volume and then cache any user data locally (should you not want to ping the API server for user data on every request).

Locally they may be displayed as an admin while the cache says so but on the API server, there's no way for them to make such requests if the role has been revoked.

The greatest flaw that this article assumes is that everybody loads their JWT tokens with all sorts of personal info. This is a horrible practice. While theoretically JWT tokens support this, it's by no means a best practice. In essence, he's arguing against an anti-pattern which is already a known anti-pattern.
Shopware 5 SDK for PHP
> stateless (ie. no round trip to the database on every call)

AFAIK, Stateless is about independent request/response and not needing a server to retain session information through the course of multiple requests. It has nothing to do with whether or not you're checking a database to cross-reference credentials - and I wouldn't keep anything more than an ID/name in a JWT... ever.

https://en.wikipedia.org/wiki/Stateless_protocol
Actually, they do use green - they're more reflective in green than red/blue, but it's still mostly absorbed.

Apparently at high illuminations you want to be using green too - the issue is that red and blue are absorbed so well that they don't make it past the surface of the leaf and thus the plant quickly maxes out on them, while green light penetrates further and thus reach more tissue.

So when you see pictures of leaf greens being grown under purple light - that's because leaf greens actually need less light than other vegetables, you probably wouldn't want to do that with other crops.

IANAbotanist
Doesn't Facebook already have all of those things in one place? And also, you know, my friends?
Looking at the Amazon listings it looks like it is sold by an Amazon vendor. That suggests an interesting weakness where Amazon doesn't enforce shipping rules on its third party sellers. Also per the comments the "product" is $10 at the hardware store and this person is selling it for $40 at Amazon so that is an interesting business.

And like you I was amazed that it was sold with lye. Kind of makes me wonder if this stuff was riding in the cargo hold of some jet I was flying across country. It could easily cause serious problems.
Maybe OT, but why is one of the requirements for a better voting system "anonymous"? What's wrong with a voting system in which every citizen's vote is transparent and available? Seems like it would be much less susceptible to fraud and easier to audit that way. I don't see a problem with anyone seeing how I voted!

Maybe I am missing something?
Natanael_L I just skimmed through it but will read it later today. I worked on a prototype earlier this year implementing the blockchain part, not secure yet, specially it doesn't implement the end-to-end encryption. Anyhow you can read about it here and there is a link to the video of the prototype https://medium.com/@jagbolanos/votosocial-org-towards-an-e-v...
The author is confusing a ponzi scheme with a bubble. A ponzi scheme implies deception (get a fantastic interest rate which is clandestinely being supplied by your own invested funds).
Since The DAO is completely open in the way it works, that would be impossible by itself.

The author actually talking about the creation of a bubble. However, usually, bubbles are created in things where the potential profit is unclear. Otherwise it's hard to justify. Who would buy The DAO at a greater price then its book value in ether, if they simply expect to extract the same amount of ether out of it after 48 days?

So, such a move by The DAO will probably not create a bubble or "a ponzi" or whatever. It simply is an investment choice with likely no far reaching implications, as far as I can tell.
I know full time devs there who were getting under $100k, granted this was 2-3 years ago.
https://lists.w3.org/Archives/Public/public-payments-wg/2016...

Verbatim from Apple:

"There are several differences between the Apple Pay API and the Payment Request API, and we look forward using the experience we've gained while working on it to help push the Payment Request API forward. We'll follow up with specific emails or GitHub issues on the main technical differences. A couple of the more important differences are:

* the API requires merchant validation, ensuring that bad actors' access to Apple Pay may be revoked;

* the canMakePayments() and canMakePaymentsWithActiveCard() methods help ensure we reveal user information to the site responsibly."
But opression!
/s
What he said, a very energetic exothermic reaction, which if something was trying to contain it, would probably result in rapid unplanned disassembly (RUD).
Metered connections are the "deprecated" technology. Apple really does assume a world where the marginal MB of data is effectively free. (See, for example, the Wi-Fi Assist feature.)
In a system where your vote can be verified, you can be coerced into voting a certain way.
HFS+ can be configured to be both case-sensitive and not (the default). So in that sense it's a regression.