skysight-inc/HackerNews huggingface dataset:
Have you measured how long typical terminals take to respond?

Regarding the third point, it might be a good idea to just feed it to XParseColor and process it from there.
OpenStreetMap without servers
Senate Democrats Are Filibustering for Gun Control
This seems like an overly optimistic view of the abilities and resources of distribution package maintainers. The reality is that no matter how hard they try, it's almost impossible for them to keep up, and even with a non-LTS Ubuntu release train I still need to use a number of PPAs and other mechanisms of install to get some things I use on a daily basis.

And that's with both Canonical and Debian's resources involved in making sure that I get a relatively up to date base set of packages.

Never mind the issue of when your politics don't quite align with any distribution maintainer's in the whole.

(Note: edited to clarify 'bleeding edge ubuntu' as meaning the non-LTS release train)
Osm-p2p: a peer-to-peer distributed OpenStreetMap database
Biochemist explains the elements of life, sex, and aging
How Ansible Took Down Our Servers
Yeah, I've noticed the same thing. I remember talking to a fellow CS major soon after the iPad came out, a guy that was going onto grad school, he couldn't understand why anyone would want one, because technically a laptop can do basically anything an iPad can do, right? And it's more powerful to boot!

It's the same people who don't understand why everyone hasn't already switched to using functional languages, or think that functional languages are equally easy to learn. Yeah, they may be equally easy to learn if you're a hardcore CS/math nerd, but that doesn't describe most people, heck, it doesn't even describe most CS majors!

I wonder what it is that makes both hardcore open-source nerds and marxists very utilitarian and blind to user/consumer-friendliness. Both are communal/anti-profit movements, but on the surface that doesn't seem directly related to "not caring about UX".
Developers Developers Developers… Are Expensive
I'm an American who is miffed about paying $6 shipping. Shipping is sort of broken these days.
Yes that's equally simple minded.
Friend Fuck or Follow
I thought they joined the linux foundation?
Prebiotic Molecule Detected in Interstellar Cloud
I broadly agree with what you said about gambling, but if you take that type of reasoning too far it can lead to some dubious conclusions.

If I'm free to add fudge factors to a utility function in order to explain an agent's behaviour, the assertion that the agent is rational (i.e. maximises utility) becomes meaningless. I can always add more fudge factors to explain deviation from rationality.

Much better to specify a utility function in advance and test how well the agent's behaviour fits your theory. IMO that's a trick economics often misses.
Useful or not, it opens an extra attack vector on the server. Parsing logs is always a dangerous area from security perspective.
imagine for a second a user management system that lets an administrator edit other users profiles

Just my $0.02, and this might be taking us out of the scope of discussion (maybe not?) but I can't think of a good business reason why an administrator needs to control whether or not the end user can use a function like autocomplete. That seems like micromanaged minutiae that will annoy my users more than help them if it's something they rely on for data entry. And if that's the case...why bother touching it in the first place?

Training/security policy that says "Be mindful of how you use this feature" to avoid any awkward NDA/HR situations? Sure, absolutely 100%.

Curious what others think on this?
Enough of this. People have the right to install last version of software easily without having to upgrade the whole server at once. ISV have the right to package their own software.

If MongoDB is a commodity I can gladly stick to the distro version. If I'm developing something of more cutting edge I want and will install the latest version from the ISV repo.
Apple’s research secrecy hurts industry and academic research
Yes, "should" means "that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course."

From what I can tell, while one might disagree with how the Chrome team has weighed the implications (such things always involve subjectivity), they seem to have both understood and weighed the implications before making the decision.
And that's the fundamental problem with ARM servers...
> I think it also stops loads and stores to be reordered with other volatile loads and stores, and yes, it indeed is typically useful for memory mapped i/o, interrupt handlers and such. But most of the time it's not the right thing to do.

It only prevents reordering by the compiler. CPU can still reorder them as much as it pleases, volatile doesn't affect it at all.

Of course you're pretty safe on x86. Not so on other platforms. Typically you find this kind of issues when porting x86 code to some other platform. X86 writes are always in order with other writes. Loads are always in order to other loads. Just need to remember loads are sometimes ordered before stores.

Again, volatile does not prevent CPU from reordering stores and loads.
Flow Wave's tribute to LIGO: https://www.youtube.com/watch?v=qvU5ytghMdQ

That's an impressive swimming pool ;-)
Yes, but since the key resides with admin and not on server, I am assuming the private key will be stored securely.
yes but apps? Apps are just a relict of the mobile 1.0 area, which should be dissolved by web 3.0. yes the monopolgies build their devices and used them to create more monopolies. It should be eventually by models of hardware/software symbioses which gets more benefits from collaborating (blockchain backends). Its very good to see a lot of blockchain related projects at the conference, the path to web 3.0 is open!
How to Integrate Growl Type Notifications into a Rails App
it provides you with backup codes that you print and put somewhere safe
Is OTP not performant and Graphhopper is? Maybe you could elaborate?
The mainframe is dead. Long live the mainframe (rumor Z Systems division sale)
Why is it smooth under OS X?
Yes they can, there is nothing preventing them creating the package. But it shouldn't be a primary way of installing package. If you really need bleeding edge for development you can build it yourself.
Co-founder of MIT Media Lab Nicholas Negroponte was reported to have said " “[Apple] has not written one research paper or attended any external research meetings, such as working groups, government-funded workshops, or held their own onsite research meetings with external scientists in the way Google, Microsoft and Facebook often do.”
> This is doubly nasty in that Windows will insert a memory fence

Windows is not inserting any memory fences anywhere in your code. MSVC cl compiler will also only do so when you specifically ask it to do so by using an intrinsic.
Fantastic! There's a book by Charles Stross called "Neptune's Brood" (https://en.wikipedia.org/wiki/Neptune%27s_Brood) where the central character is a historian specialising in these kinds of frauds. This includes futuristic versions where the 'Spanish Prisoner' is offering 'slow money' to in return for 'fast money' to help finance a new FTL drive:

> They're not poor: Here see these slow dollars signed by a bank a very long way away? Won't you hold them as collateral and front me a sum of fast money to help my friends make their repairs? We'll accept a ruinous conversion rate, just in return for the money we need to get our space drive working again; when the bank-countersigned certificates for these slow dollars reach you, you'll be rich!
Bitcoin Visualizer
If you're using feature based project structure, it really isn't bad. Typescript doesn't offer that much over modern JS development with webpack.
Operational Best Practices
Fast and broken.
I doubt most products on aliexpress pay royalties, or really give a damn at all about licensing.
none, as far as I know. First likely to become available is probably going to be http://www.lenovator.com/product/103.html - they're claiming Q2 2016.
Yes, I see a lot of reaction around Unity. To be honest, I had to google it to find out what it was. I have always used Ubuntu Gnome, so I had no clue about Unity nor its issues.

Back to the topic here, I thought someone could outline a security checking for an ubuntu desktop to assess how secure the system is -- or maybe making it secure from a clean install.

Edit: grammar
There's plenty of places like that. We couldn't hire the former CTO from Netflix, but maybe we could hire some VP/director that couldn't go any higher as our CTO.
I'm just praying it's not some new lodash like library I have to learn.
sounds intriguing and way more flexible, but the example is for video? i don't know anything about this, but if i had to guess i would say that any runtime code generation is worse performance wise compared to a mix of pod structs and function pointers to functions which are all known at compile time.
>so many users to over-buy games just because they're on sale

I have to say that I'm actually kind of okay with this, at least for myself. I choose to view it as voting with my dollars to let indies and publishers know the types of game I'd like to see more of.

And, admit it, it's kind of pleasant to let your eye wander over the list of unplayed games and imagine how much fun they'll be when you someday, somehow find the time to play them (even when you know deep down that you probably never will). "Wanting is better than having" and all that. And the bonus is that they're all virtual and don't clutter up the house.

Value is where one finds it. :)
I think the word serverless is being used from the perspective of whether you have to maintain it yourself. Its just outsourcing, but that is a bad word so let's make a better trendy word.

Things like Bitcoin and Bittorrent would better fit the word serverless. However, you need servers of a sort for Bitcoin to work (e.g. you need nodes and miners) and you need an initial seeder for each torrent to get going.

Since serverless seems to be mostly about a class of applications, I think only those that function either without network access or without contacting any specific organizations computers (i.e. servers) would qualify. This would make my browser fundamentally serverless, since I can browse files locally. Suddenly my browser seems like a glorified file viewer and One Note is rsync with an editor attached.
Trump oppo file exfiltrated from DNC [pdf]
In general is it just me or has ZFS become more popular lately. Saw Ubuntu get behind it, even in light of Btrfs being available for many years now. https://github.com/zfsonlinux/zfs/commits/master is pretty active...

It seems everyone at some point expected Btrfs to shoot ahead and leave other file systems in the dust, so there was no point in bothering with ZFS, "just wait a bit and Btrfs will be the default everywhere". And besides ZFS has all the legal issues with it.

But it seems Btrfs progress was rather slow, so even in spite of legal issue interest in ZFS is still growing.
Freedom for whom?
It wasn't ZFS perse... the software I was using wouldn't properly enable the drives configured as hot spares... that and a few errors (I didn't use ECC), and a couple bad drives, and everything (11TB of data) lost. All the really important stuff was well backed up, as was my audio library. I never did re-rip all my DVDs & BluRays again since that happened.
This is a really great project!

I assume that you run this on Twilio (or a Twilio-like service). I'd be a bit wary about an advocacy organization getting ahold of this and running up your Twilio bill. Do you have any plans to open source the code behind this?
Yes. PCI is a silly substitute for actual security. But the alternative is that many banks and their partners will run with no security because bank executives as a class are firmly opposed to sharing authority with competent IT security people.

This is one cost of their class solidarity.
Jim Aspnes also teaches a Randomized Algorithms course, with similarly detailed and well organized notes available: http://www.cs.yale.edu/homes/aspnes/classes/469/notes.pdf

He's a fantastic and engaging lecturer as well. I highly recommend taking a course with him if you have the opportunity.
This blog contains some thoughts about business models and how to build a diverse & healthy community around Free Software initiatives.
On that topic, how about the ability to disable manipulating of copied text (is there a name for ctrl+c injection?)
Hope this goes viral in some way. I think it can make non technical people aware of the problem.
Except, it is a SHOULD.
Makes sense to me, assuming 'til' is 'iota' and 'prd' is 'fold-with-multiplication'.

I don't know Q, but I'd guess you read it right-to-left like J/K/APL. `x` is the right argument (in J it's `y`), so if we were to call `factorial 5`:

1. Create an array of [0,x) | 0, 1, 2, 3, 4

2. Add 1 to each element of the array | 1, 2, 3, 4, 5

3. Fold the array with multiplication | 120

Array languages are super elegant and fun once you use them a bit.
Okay, wasn't aware of that option... mainly going by 8TB WD reds on amazon, and figuring 12-12TB should be around soon.
Check out http://www.savemyserver.com/ and look at something like the PowerEdge 2950 III.
no, my point is exactly that the 2 in 2FA is inherently annoying, because you need to have physical access to 2 different devices at the same time.

How does it prevent password reuse? You can use the same (weak) password to lock your phone and login to your banking account (which is again, a false security). However it could be easily circumvented by random generating secure passwords for users (which needs clever advertising like 2FA, because they prefer convenience otherwise). In this case your phone is a single point of failure. You could even argue it increases the attack surface.
Actually, the standard says that "on" is a MAY, but "off" is a SHOULD.
You can now transfer iTunes purchase into mp3s, right in the iTunes software. As such, I'm not sure if I'd call it a locked ecosystem anymore.
Note: It may be worth providing a bit more info about why you are linking the article. It's a relevant example of the counterpoint playing out in real-time, which people may miss from the simple preface "In other news:"

To ensure the operating system is stable and reliable, OS distributors do not make major updates to packages such as OpenSSL during the lifetime of each release.

Not entirely true. RHEL backports bug and security fixes continuously, and select feature enhancements are rolled out with point releases. For example, RHEL 7.2 updated mod_nss, and enabled TLS v1.1 and v1.2 in NSS (I'm not sure how that interacts with Nginx, if at all). I imagine RHEL 7.3 should be coming out any time now. Maybe it will help with this.

1: https://access.redhat.com/documentation/en-US/Red_Hat_Enterp...
> Linux on these types of devices is not interesting to me, as every such device comes with it. It's neither different nor original.

Being neither different nor original seems like a plus, when it comes to servers. Having a predictable, internally-consistent standard system would be best. Easier management, easier configuration, predictable behavior between machines, and all that. Of course, the opinion of which system it would be better to standardize on would be a matter of opinion.

Also, I think anyone trying to run any sort of serious server on a CHIP is using a nailfile where a screwdriver would be better-suited.

If it makes you any happier, ZFS is doable on a Linux-based SBC. I found a fair amount of documentation of it being done on the first generation of Raspberry Pi.
ActBlue CSRF Security Vulnerability Responsible Disclosure
> So if autocomplete breaks functionality then there's nothing the user can do if the developer assumed autocomplete='off' would continue to work.

Developers should not expect that things specced as hints will be treated as authoritative direction and should not make software that breaks if that unreasonable expectation doesn't hold.
Well... there used to be some kind of `FreeSteam`. But keeping it up-to-date was indeed a hassle for both the `maintainers` and `users`. Not worth the time once you get a paycheck or enter college.
Was this supposed to have an associated link?
Cf. The Dark Lord of the Internet [1] and the relevant HN discussion [2], which give an interesting peek into the psychology of internet scams.

[1] http://www.theatlantic.com/magazine/archive/2014/01/the-dark...

[2] https://news.ycombinator.com/item?id=6972139
Good. It's taken far too long for user agents and web standard to remember that the intent of a user agent is to be an agent for a user, not something that an external server can dictate with pixel perfect precision.
Why don't you use, you know, a password field for entering that password?
Here's an Ansible role (I made it) that automates the steps described in the article: https://github.com/LucianU/ansible-secure.
Except, Google themselves now do "google-chrome-autocomplete-off" and "both" and similar values instead.

We just replicated the PHP or IE situation with mysqli_real_surely_this_time_it_works_escape_string or autocomplete="sudo-off".
You've completely missed the point of the comment.

Your parent was describing a system where an Administrator edits other users' data. If that Administrator is using Chrome while editing a user, then there is no way to disable autocomplete, and the browser may fill the user's form fields with the Administrator's information resulting in bad data.
I'll just let my ISV do that for me, thank you.
Yes, and neither is a MUST.
This usually works OK in practice for small or medium projects, but as Brooks points out in the Mythical Man Month, you are also tripling your estimation error. This can cause a lot of divergence for longer projects.
I mainly mean that it'll be a while before btrfs stabilizes and even then, it's been how many next-gen file systems in floss land each with critical issues, usually non-technical in nature in even the past 5 years?
Show HN: Manage your tasks without leaving the Telegram app (at)toround_bot
Ask HN: What programming language has you really excited lately, and why?
I realized that almost all I ever do on HN is press Cmd-F, type "lang", see 0 results, and close it. So I figured I'd just ask y'all instead.
I'm not very familiar with autocomplete behavior, but does this work across domains? on hidden fields?

Would this help <malicious website> or even <legit website but with malicious tracking intents> to extract information without my consent?
Good info, thanks. I'll admit, I'm pretty terrified of having to replace one of the drives in my array. I've replaced dozens or maybe even hundreds of drives in Sun, SGI and DEC storage arrays over the years, but I have a lot less confidence in my homebrew setup. Fortunately, I have regular complete backups of everything there, so even if I lost the whole array, all I'd really lose is the time involved in fixing it, but that's still painful.
New Startup Brings Bartering to Ebay
> runtime code generation is worse performance wise compared to a mix of pod structs and function pointers to functions which are all known at compile time

Having "a mix of pod structs and function pointers" is analogous to having an interpreter for some scripting language. Do you consider interpreted scripting languages fast?

Interpreters are slow pretty much for that reason. Having to chase pointers.

Runtime code generating JITs wipe floor with interpreters, being usually 10-100x faster.

Now I'm not saying your application will be 10-100x faster, but done right, it'll absolutely be faster if your performance critical "inner loop" / filter chain needs to currently follow pointers. It's just a question of how much and whether it matters for the use case.
ZFS pool IO performance drops like a rock off a very tall cliff once the pool is in the 80%+ full range. So for every TB of usable pool space, you need to over-provision by 200-300GB. This is with current gene enterprise SSDs mind you. Even worse things happen when using spinning rust -- like ZFS dropping drives from the pool because IO has degraded so much it thinks theres a bad drive.

It turns out that some raid controllers (Including the very popular LSI variety) + certain kernel versions result in pools and drives being dropped from the array for no discernible reason. Nothing [useful] to logs, just reboot and pray

Non-ECC RAM is just asking for trouble in any circumstance where you care about both data integrity and IOPS. Bitflips can and will get you, now they won't wind up hosing your entire pool (most likely) like some apocryphal stories suggest. But, you'll get bad data replicated and the possibility of borking some other sector during the 'recovery' process from the bitflip.

When you're in a large enough pool (PB-scale) this becomes even more painful...
> Yes, how positively odd that after giving you lots of money they want something specific in return.

Point of clarification: Most patreon subscribers pay a dollar or two a month. If I paid a given artist, say, $250 for something specific then yes I would expect to get that thing. Patreon works more like you give them a few bucks a month and they produce what they produce in general, so getting upset with them for that is more than a little ridiculous.

I'm not sure what to call this, but everyone who chips in even a minor amount of money expects to have input and control over the product in question, to "get what they paid for", failing to realize that what they're paying in is a tiny amount compared to what is actually making it happen. It seems to be a relatively new phenomenon, but that could just be my experience.
> There's very few occasions when autocomplete being disabled makes sense

What are those (seriously, I can't think of any off the top of my head).
How is this going to work with honeypot fields? Chrome will autocomplete hidden fields like this:

<div style="display: none;">
<input type="text" name="phone">
</div>

Where "phone" is the honeypot field. Not shown in-browser, so usually only a bot will fill out the honeypot field, sending a strong signal that the form is an automated/spam request.

Of course, autofill messes this up. So the more correct implementation is to turn it off:

<div style="display: none;">
<input type="text" name="phone" autocomplete="off">
</div>

But if an autofill of "off" is ignored this technique will no longer work, as the user's browser will fill in the honeypot field.
Gamma-ray bursts emission is strongly beamed into a small solid angle. So, although their equivalent isotropic energies (that is the energy that would be needed to power gamma-ray bursts if the emission was isotropic) are huge, the actual energies released in gamma-ray bursts are more or less compatible with those of supernovae (~0.1% of a solar mass).
Angular 2 RC2