skysight-inc/HackerNews huggingface dataset:
http://www.npr.org/sections/thetwo-way/2015/12/09/459087477/...

> A just-released analysis of government data shows that as of 2015, middle-income households have become the minority. The trend is so firmly established that it may well continue; Americans have experienced "a demographic shift that could signal a tipping point," Pew researchers concluded Wednesday.
> Dividends are not taxed in tax-deferred accounts like IRA/401(k)

Only if you never withdraw them.
Yeah! We would say the same if someone propose us to use this :)

1. We share the source code of Wallarm Node (nginx-based filter instance) with the companies after signing NDA.
2. Will run 3rd party audit of the code and share the report.
3. At some point, we'll open-source it.

Ivan (wlrm) will come up with the examples of attacks soon.
Still no support for incremental snapshots though right?
I would agree with (1), but add "Most code is read at least an order of magnitude more times than it is written." Lots of decisions that save you time writing code (or save typing) at the expense of reading the code are bad decisions because of this.

Also, always put a breakpoint on every code branch and step through it at least once in the debugger. Everyone makes mistakes. Fixing mistakes at the point of writing the code is much more efficient than having someone else fix them later. If you haven't done at least this level of testing, just don't check it in. Assume code is broken unless it has been tested.
How do you distinguish 'unbiased' from 'biased in a way that matches my world view'?

I'm genuinely curious what you think about this. I'm not in the US and it sounds awfully like you don't see a distinction between the two cases.

Or you genuinely believe yourself to be neutral and impartial - which would of course be ridiculous ;-)
Considered for the most part. You will expectedly still be able to find goods and services that cost considerably more or less than in past, real terms.
QA just assures that the deliverable meets the spec. It's perfectly possible to write an excellent implementation of a terrible idea.
3d Calvin and Hobbes comic strip
Which (by design) would unfortunately mask character, warmth, and authenticity, also.
Yes, this is precisely how jemalloc works.
Interesting. I wonder if it's a usage difference. A hammer can be a terrible tool if you try to put in screws with it. It works best when the workflow is designed around it and the user only needs to remember a handful of commands to do specific tasks.
Isn't that what most click fraud is, though? Paying someone/something to click your own ads? Who would do click fraud if they aren't somehow being compensated by the ad provider?
I think the concern is stated here:

> However, many users run applications from the Downloads folder, never moving them.

Basically, unsigned apps might not work when run from the Downloads folder without changing the Gatekeeper setting in Security & Privacy settings.

I don't view this as an issue because I already have to go there to launch an unsigned app for the first time to hit "Allow."
We want to know where crime rates are higher so we can target our limited enforcement budget to where it will have the greatest effect. The whole point of targeting enforcement at problem areas is that it introduces a bias to the rate at which committed crimes lead to arrests and convictions. This is a good thing.

The problem is that using arrest/conviction rates to predict crime rates will be inaccurate if you don't correct for the biases that exist in the ways in which crimes lead to arrests and convictions.
Right now every hour (it may change). The service round robins checks from monitoring stations basically at AWS and Rackspace datacenters. This makes sure the site is reachable from points around the planet and that the certificate is functioning properly. So, in a way it can be used as an external site monitor for downtime. However, that is not its main purpose.
So I'm curious, if this can disable Secure Boot, is this a pathway to jail breaking devices that do not allow you to install your own keys?
Ōryōki Web Browser
Digital Domain's New Legal Setback Freezes VFX Tech Used by Major Studios
- Add the occasional expositive comment to help clarify intent (in places where it might be ambiguous).

- If writing in a language with weak ability to do this through its syntax, establish critical runtime invariants. This can also make intentions and system constraints obvious to the reader. I recommend invariant.js for javascript.

- Write your tests so they can all run by themselves, and do not depend on state created by other tests.

- If something is hard to name this usually means the design needs work.

- If you realize something was incorrectly named, take the time to fix it and refactor, rather than imposing the burden of working with an incorrectly named thing on other readers of the code.
Looks like the answer to the classification system is:

"The measure identifies tech companies by the type of tax code they use under the Internal Revenue Service’s North American Industry Classification System. Companies classify themselves. They may face penalties if a government audit finds they are misidentifying themselves."
Pretty nifty. Assuming the cost of this isn't exorbitant, I imagine there's the possibility to save a lot of money on buying or renting various extremely expensive vehicles for movies.
That's normal in Asia. (They swap everything in the UI when porting Playstation games over here.)
It sounds like there's more than a few people working on this idea now.

I just feel like it's a little early to be expecting users to go about multitasking like a desktop when we're still at a point in the evolution of VR tech where prolonged sessions of VR HMD use is not common behavior. Even getting users to put the headset back on after stepping away, is still a challenge. Not to mention the difficulties of reading text in VR among other issues.

That's not to say there isn't a use case for a multitask desktop in VR, it's just that this is a problem to be solved in the future. In the present, we simply need software that gives users a good reason to put the headset back on again after the novelty wears off
I used to feel the same way about HN, as being an echo chamber, but my feelings have shifted somewhat. This community does not like negativity, especially towards others. If you come up with a positive sentiment that expresses your opinion, it is much more likely to be voted up. Of course, not all things can be dressed up in positivity, but many online forums suffer from an excess of needless negativity, and HN is a breath of fresh air in that respect.
Is there an api?
Well, it is currently at 0.43, and since we know that the last 10% of the project takes 90% of the time we can expect the 1.0 to release in approximately 232 years.
Document Liberation Project
JotForm supports recurring payments, both for Stripe and PayPal. Let me know if you need any help.
So I've read the PP piece and your article, and I think your criticism is way off-base. The most technical part of your argument relies on a p-value being .057 vs .05, which is not a good one. No one seriously believes that .05 is magical number that determines true from false; things that are close to it but not quite below .05 are not automatically false.

They go on to give supporting analysis in form of the false positive and false negative rates by race, which is pretty compelling evidence. You claim to not believe that because you cant find it in the notebook but its literally right underneath the Cox model section.

I was intrigued by this article and went a step further to plot the ROC curves and the evidence is solid. It's messy, but you can see it here https://github.com/stoddardg/compas-analysis/blob/master/my_... in cell 78. Its quite clear that the algorithm is choosing a different point of optimization on the ROC for white people (a more lenient one) than for black people. A white defendant with a risk score of 5 is as likely to commit a crime as a black defendant is with a score of 7. That's an obvious case where you could simply relabel and be more fair but their algorithm chooses not to.

I also hate when people abuse bad statistics and reasoning to sell page views.
> If they were going to run the whole thing in a SECCOMP container anyway, there is little damage a compromised C library could do.

Not really. For instance, a compromised library can still rewrite the file you're storing in DropBox to contain different contents, which could ultimately result in remote code execution when you redownloaded it. Seccomp only makes sure the decompression server is safe from a rogue process.
yes actually it does!

It needs some work with focusable things, I needed to use the special navigation keys (I tested with ChromeVox on the desktop) to get to the lists on the left and right, and to click on anything i had to use the special "click" keybinding instead of pressing enter, but it's 100% usable.

On android it works great, about the same as any other website or app (i used the android accessibility screen reader to test)

Modern screen readers are just as capable as the rest of the browser, the only place they fall short is in image-heavy sites that don't have alt tags. Obviously you can greatly help by adding things like aria tags, and using markup as much as possible, but it's not like they just don't run javascript.
Summer camp with an open bar: retreats for stressed-out adults are big business
Dash: People and Code Working Together
Your quote makes me feel like you are targeting code lines/chars.

Less cpu cycles != less lines of code.

For example, bubble sort would be little more than 10 lines where merge sort would be twice as that.
Blake from Layer here: I'll definitely share your feedback with the product and marketing teams. Here's my version of a summary for a developer-centric audience:

Layer provides a comprehensive platform for adding rich messaging experiences inside other products. You can think of our offering as similar to iMessage or Facebook Messenger as a library / platform. We provide native SDKs on iOS and Android that provide a high-level development experience for implementing messaging. The SDK abstracts away all the low level details of implementing a great messaging system on mobile such as content synchronization and managing a persistent connection while still providing the developer with full control over the user experience. We also offer an open source UI toolkit called Atlas that provides a reference UI implementation on iOS and Android.

In addition to our mobile offering, we also provide a Javascript SDK for browser clients as well as raw REST and WebSocket APIs for other platforms. There is also a rich set of integration APIs in the form of backend to backend REST APIs and Webhooks for tracking events within the system.

The platform is fully managed and offered as a service. Historically our availability has been very strong, but last night exposed an achilles heal and we are working quickly to remediate the issues exposed.
go PiedPiper go!
How do people view search engine results pages?
Why do people in tech think "proving you can do your job" is unique to tech? Tons of industrues has practical interviews. Do you really think a roofer shows up and says "I know what I am doing, just take me on my word" and gets a job?
It's almost as if men and women have some fundamental differences in psychology that affect their preferred choice of career.
Well, usually my code does not run in space. ;)

But you are right, tests are biased. Pair programming can reduce the chance of code/tests being biased in a negative way.
Yes, but then the attacker can ignore your JavaScript and just send the hash value they got from the dump. If you calculate hash(password) and send that for comparison to the hashed password stored in the user database, then hash(password) is your password from then on.
Read and learn from ruby code, because it clarifies intention and is expressive. Express intention, instead of code. Name variables, functions, logically in the problem domain where you are coding for. If you write your code in such a way that you can read the intention of the developer, such the contract/api, the future you, or your colleague can rewrite the guts of your methods but the signature would still communicate the intent.
I don't like Trump either but there is a wide gap between not liking Trump and not being able to be friends with someone you think are wrong.

Hey, I personally believe the majority of my fellow citizens are terribly wrong in what I think are important cases but it doesn't prevent me from being polite and decent.

Edit: I might have missed your /s, did I?
It is, and will remain impossible to deduce a victims password from such a small timing sample.

There simply isn't enough data.
CS papers don't usually publish code, given that the code is usually research quality (read: built for a specific hypothesis, usually hard to port and generalize). Technically speaking the implementation for the code is given in the paper, which means someone could definitely build it. You also don't really want a tool like this for botters in an easily accessible form.
How Our Carrier Failover Kept Data Moving Last Week
Working for other people is a scam. The majority of 'employees' are never paid what they're worth. Employees are usually mistreated or taken advantage of, heck the entire 'internship' thing has become an exploitative form of slave labor.

I'm not surprised they were fired. The environment has become so toxic.
It's not even a given that you'll know that's the problem. Some of your data is wrong, some updates are lost...are you guaranteed to see the issue and be able to rule out that it was your code?
I actually like Hillary, and think she'll be a good president.

But she pretty obviously committed a felony.
Clever is the enemy! Simplicity is key.
The NYT blog post starts out discussing regional dialects, then presents a study of 23 Southern Californians aged 18-22...

The only study the post links to is paywalled and the link to a conference paper is dead.

Your second link is also paywalled.
Some real time image convolutions with histeresis. We ended up switching to a Xeon Phi and abandoning the portable version.
urbit dev here: we completely agree that we need to have useful apps on top of it. We have an alpha for super simple wordpress-like hosting (in fact, the urbit.org site uses it!). All you have to do is drop a few md files into a tree and you're ready to go. See http://urbit.org/docs/using/web/

Joey Krug, founder of Augur, had a great post on how he could see Urbit as being a great compliment to the blockchain[0]:

"If the blockchain is useful in those areas where [almost] no trust exists, Urbit has the potential to be useful for essentially everything else.

To give a concrete example, this would be useful for any Ethereum app that doesn't want to store data on a central server (which most cannot do whether for legal, security, or ideological reasons). The idea to me is that the internet wasn't built very well to run decentralized apps [which is definitely the case if you've ever tried building one without having to rely on central servers for caching, storing accounts, comments, etc.]. It's, imo, a nice complement to blockchain tech like Ethereum and Bitcoin. Long term once it's out and running I see dapps like Augur [a decentralized prediction market which I work on - http://augur.net] using it so users can securely store their private keys, report data, market data, trade history, etc. and easily go across/between devices as opposed to just using localstorage [which is a pain to migrate using] or fetching it from ethereum every time [which is very time consuming and has lots of overhead].

If we're going to seriously move in this direction of decentralization, at scale we need something like urbit. No one else is really tackling the same set of problems.
Came across this quote on it by Alan Kay: "They have verve, and that's generally a good thing. In this case there are a lot of details that need to be grokked to make any reasonable comment. The use of combinators (a kind of dual of lambda calculus) harks back to an excellent thesis by Denis Seror at the University of Utah in the 70s that produced a safe, highly scalable and parallel implementation. I haven't looked at it more deeply (and probably should)." [https://news.ycombinator.com/item?id=11810177] - very cool!"

And finally, another idea: https://urbit.org/posts/objections/#killer

[0] https://news.ycombinator.com/item?id=11817721
Reliability != stability (in this context).

I can reliably ssh into pretty much any server and use default vim. I cannot rely on a given plugin to be installed on the server. The more you customize vim, the less universal your knowledge of vim becomes. It's not a big deal to learn some plugins, but it is worth bringing up if people are talking about the ubiquity of it.
This famously reminds me of this fiasco
http://blogs.wsj.com/digits/2015/07/01/google-mistakenly-tag...
gees, even my $9 C.H.I.P supports OpenGL (ES). Talk about historyware.
Judging by the downvotes, obviously some people have no idea how maintaining libraries work.
How do you know that they did? It's up to eBay to state that they changed to a non-default setup, not on us to assume so without asking.
It's my experience that most Open Source users pick Open Source because it's free.
3-7% looks more pink than beige to me, but I'm a little red-green colorblind, so what do I know.

IMO it would make more sense to show 0-3% real return — strictly above inflation — as beige and 3-7% real return as a shade of green.
I think it's more because those are either dangerous, or not well paid, not because they're not cool or important. Generally, more dangerous work gets some kind of hazard pay premium. You'll see the same kind of thing with work that requires lots of travel, like truck drivers. A lot of my family does work out on oil rigs where they stay for a couple weeks at a time - they get hazard and travel pay, so it ends up being quite well paid.

There's no downside to the field on the dimensions of pay and danger. Software engineering/development is safe and well paid, thus there is an unqualified incentive to get one's favored group into the field, and if there is a perception that there is a systemic internal bias against them, to attempt to alleviate that bias.
When "better" means "fewest bugs":

1) Use the best language you can get away with. This means using a language that eliminates entire classes of run-time errors via some or all of:

a) Strong typing

b) Static typing

c) Managed memory

d) Immutable data

2) Assume that your code will be maintained by somebody who doesn't know your programming language as well as you do.

3) Use static and dynamic assertions liberally.

4) Ease debugging. Have great formatted dumps of your internal data structures, great internal consistency checking, and great logging. Automate problem isolation, too: for example, in an optimizing compiler, at each point where a discretionary change is about to be made, call a function that logs the change, increments a counter, and returns false if the counter is past a limit that you can set in the environment; this allows an automated bisection analysis to immediately find the change that broke a test program.

5) Regression tests. Once you fix a bug, make sure that your test suite will notice recrudescence.

6) Don't hire or retain sloppy programmers.
"As an older friend, I must advise you against it, for, in the first place you will not succeed, and even if you succeed, no one will believe you" (Max Planck to Einstein on his pursuit to develop a new theory of gravity).
To be fair, my wife is in medical school, and gender imbalances in specialties is brought up all the time.
Rust for Node developers
Is there a secondary market?
Practice, you cannot get better at coding by just reading blogs or books.

You have to get your hands dirty trying things.

Always try to keep things simple and short and choose good names. You may have to come back to your code months later, and being able to quickly grok what you wrote pays dividends.

Pick a side project working on something you enjoy. If you work at a corporate job during the day, you may not always have a good opportunity to grow and try new technologies.
That is not at all how the market works.
That's a pretty good description of peer review. It varies, but generally the people chosen know the topic and are good representatives of the community, even if only 1-3 people.

For good venues (journals and even conferences), I think the biggest limitation is not the people, but the information contained in the paper. You can't answer all questions and show every last detail.

People are frustrated with academics, but academics are frustrated with how journalists and readers interpret their results.
Transportation in general is weak in the US compared to other countries.
Also, lets say it detects a 'malicious string' what happens then? Can you force a new handshake with your root CA now as the signer in the middle of a request? I'm not positive but I don't think you can without having the root certificate to begin with. Then what do you do? Just allow the connection to timeout? Sounds pretty bad from a usability perspective.

> Some existing systems mount a man-in-the-middle attack
on SSL by installing fake certificates at the middle-
box. This enables the middlebox to break the security of SSL and decrypt the traffic so it can run DPI. This breaks the end-to-end security of SSL, and results in a host of issues, as surveyed by Jarmoc.[0]

That slidedeck they cite also notes a number of issues with middleboxes that are unrelated to decrypting the traffic. If the middlebox does not have a fully updated cypher suite then it can essentially do a downgrade attack on all of it's clients. Many of these middle boxes in the past have been found to do boneheaded things like accept self signed certificates as well. A mess all around. I say sandbox the browser and be done with it.

[0]https://media.blackhat.com/bh-eu-12/Jarmoc/bh-eu-12-Jarmoc-S...
There is an API - REST/JSON based but not yet documented. It will be available soon. With the API, you can get results to pull into your own systems. The application is 100% API based, including being able to add your own monitors without going through the website.
I like and enjoy the book.I have been searching for this link for a while as it was posted on HN sometimes ago and i forgot to bookmark it.Thank God that someone re-posted it today.
And keep up the good work.