skysight-inc/HackerNews huggingface dataset:
This is not really ideal either, because the hash becomes the password. If an attacker got the hashes from your DB, he would only need to send the stolen hash to the server to authenticate.

The ideal way to deal with passwords would be something like SCRAM [1], but you are adding a bunch of complexity on the client side, and you'd need to trust your JS libraries.

[1] https://en.wikipedia.org/wiki/Salted_Challenge_Response_Auth...
I did some penetration testing on the Snapshat application last year. It was also very chatty every key-press on the craete/login screens.
Agreed. People here are mostly thinking "brilliant computer scientist" or "will cure cancer," but many universities have degree programs that are revenue generators, requiring full tuition payments from students and attracting many foreign nationals, which may not be held to the same standards as other programs. These programs serve plenty of students from China and Saudi Arabia whose parents are making an investment in getting an American option for the their child or the family. This is a very rational decision, but I don't think that it serves US interests to give an automatic green card to a kid from (pardon my apparent condescension) Directional State U because his parents paid enough to get him to scrape through a master's in geology or CS.

I'm at a big state U, mildly insulated from the pressures to develop a program at which anyone can succeed, but I have a lot of academic friends who have encountered significant pressure from administrations to keep pass rates high in revenue-generating STEM programs (many of them masters' programs). Attaching a green card to the diploma is a boon to these programs and some non-US students: all the incentives are there to just keep taking that full tuition and graduating students without working them too hard. Win-win, and it cuts down on the end-of-semester "I have to leave the country if I fail!" conversations, which I've had several times and are always unpleasant. These micro-level problems could lead to a flooding of the market with people whose educations just aren't that great.

Coming from a family of immigrants, I'm all for making green card processes more efficient. Knowing America's education system, attaching a green card to diplomas of STEM graduates is pay-to-play and that's not cool.
That's part of Bernie's thing, even if he can't win the nomination he can put a lot of populist candidates into government positions. It's one reason why he hasn't stopped campaigning, he can use his campaign's money to finance candidates in lower races.
Guess who will be working late patching Anti-virus software tonight.
Yeah so that my Grandma who had Comcast install her router should definitely be legally culpable when there is a firmware issue with the router, or when the installer sets up a weak password (or none at all). I think you are probably speaking from a tech support perspective where you have had to fix systems that haven't been patched for years and that caused issues. Well, most of the population would be screwed by laws like this thru no fault of their own.
Why not curl | grep?
Ugh, I had to do this once on the sign up page at a small company I worked for about 10 years ago. Ever since then, I've been weary about beginning to fill out any forms unless I really, really want them to have the info. I still think its messed up to store user data that hasn't been submitted.
It gets better after a year or two of consistent monthly cash flow through one account, but $diety help you if you ever want to switch banks!
Your savings from the contract renegotiations is impressive.

Can you provide a little more insight on this "Then with our email infrastructure provider we were able to switch to a managed service, saving about $900 per month."

What email infrastructure did you have in place before and is the managed service you are now using dedicated servers or something else?
PubNub. We have fantastic uptime and do over a trillion transactions a month flawlessly. We also do some cool blogging too. (my job :)

http://www.pubnub.com/
You may want to also consider refactoring this code. A function should do what it says, not have unexpected side effects.

Not only can this be surprising to a client, but it also makes it difficult to leverage the code for reuse elsewhere ("I only wanted the IP address, not the rest, guess I'll write one called getIpAddressOnly", etc).

Functions like this also tend to become muddled and difficult to maintain because as time marches forward, functionality may need to be added between these side effects, and again, unless it is refactored, it has to end up within the same function, making the whole problem even worse.
Nothing you said is restricted to STEM education. Do you favor eliminating subsidies for K-12 as well? If not, why not?
i would find this annoying. Sure it depends on how exactly you use slack, but when i am in a channel i am there because it is relevant to my interests/tasks and when i get a new message i expect it to be relevant as well. Having unrelated messages popup would be the real time waster, because i still have to parse them to make sure they are not again relevant to me.

We've used "task force" channels tho for specific problems that got semi open discussed in documented in these channels.
People commonly spend US$80+/month on training deep learning models on EC2, when you can now buy a brand new 980Ti for $440 from newegg, and the very capable 970 at $280. If you don't have a motherboard/PS that supports 2 video cards at 16 PCIe 3.0 lanes each, it's a worthy investment.

There are wrinkles like if you're doing double precision arithmetic, consumer cards from nvidia since the Titan blacks are 12:1 fp32:fp64 or higher i.e. double precision is relatively slow. Radeons/openCL might be better for the purpose
If you hash it you can't determine the "strength" of the password except maybe looking up the hash in a rainbow table.
A proposal, which was a PETITION, made by interns, that have absolutely no capital with which to bargain, let alone demand via petition, over the company's culture. It's insane.

There is a big difference between an open-door policy and allowing a group of interns, most of which are a net-negative for the company while they are interns, to petition the company's leadership to change their culture. The intern writing the letter even stated that they had already had a conversation with their manager about it. Sounded like that convo went pretty well. "We appreciate your view, but no, the dress code is not changing". That is a good open door sounding culture.

"Special Snowflake" is pretty fitting here. You want to band together with fellow interns to make changes at the company with which you are interning? Make that company some money. That's why they are in business. That's what they will listen to. You are a "Special Snowflake" if the dress code is the sword you are going to fall on. It's nuts and these kids need to grow up.
What Makes Wikipedia's Volunteer Editors Volunteer?
Yes, and you can also be be right most of the time, and have below market returns because of transaction costs or management fees.
I agree that quantized pitches are a great waste of a synth's potential. William Sethares did some very interesting research on consonance perception, which can be used to construct microtonal tuning systems without the dissonance usually associated with them. Here's an good demonstration of what you can do with arbitrary pitches:

http://sethares.engr.wisc.edu/mp3s/three_ears.html

"As each new note sounds, its pitch (and that of all currently sounding notes) is adjusted microtonally (based on its spectrum) to maximize consonance. The adaptation causes interesting glides and microtonal pitch adjustments in a perceptually sensible fashion. "
There are a ton of great alternatives. My favourite is the Demand-Revealing Referendum:

http://stumblingandmumbling.typepad.com/stumbling_and_mumbli...
I disagree.

Whatever the server receives, it should do all the good things, salted hashing and what-have-you. But no one says what it receives needs to be a plaintext password.

Hash on the client side before sending- unsalted, or salt there as well and pass it along to the server- but let's just ensure that the server never has the ability to see a plaintext password. It can't log it, it can't accidentally leak the plaintext.

Will that solve all problems? Oh, hell no. But it at least strengthens the mitigation against certain attacks or mistakes.
And then that index fund has to take the loss that comes with having bought a stock that failed and sell at a loss, while not capturing the gains of stocks that got big enough to make it on the index.

Shouldn't the index "return" thus diverge from the return of an actual index fund in practice given enough years?
I generally agree with this comment, but wanted to pull out one nugget in particular:

> don't assume the person before you did it wrong or was an idiot until you can prove it.

Heh, I don't want to count the number of times I've looked at a line of code and snarled about how stupid it was... just to git-blame and find out that I wrote it. Nothing will break you of the habit faster than maintaining your own code.
Like Colin Powell?
But fewer complaints of H1-B wage slavery (note: I'm exaggerating somewhat), which also suppresses salaries. Hard to say which is more significant an effect.
This sounds eerily similar to an experience I had. The CEO of a 10 year old company that kept growing in revenue and profits (even during the recession) went from being the most level headed and inspiring person to totally incompetent. He suddenly gave up and stopped coming to the office and and gave the employees a free reign to do what they wanted. Things actually worked but every time we needed his involvement he would show up and just fuck everything up.

After months of declining business he told me privately that the reason for his behavior was because he was burned out but felt everything could be fixed in 6 months. I didn't stay to find out and quit immediately. 6 months later those who remained ended up working 3 months without pay and found themselves out of a job while the CEO declared bankruptcy. Towards the end I heard he got more erratic and started blaming the employees, the board and everyone but himself for his situation.

It still baffles me how someone who seemed like he could turn anything to gold and had such good judgement could suddenly lose everything and become so hopeless because of burnout. Over a year later he still hasn't recovered and is being sued by several people.

Since you're an engineer - I'd say tell the board (verbally) what you think and put in a notice of resignation. If they change things for the better they might ask you to reconsider your resignation. If they take offense and side with the CEO - you're better off quitting anyway.
I don't think may would disagree with your sentiment. I think there's disagreement as to how change realistically happens.
for online tech talks, you could also have some kind of phone app that would show the slides
Bridging the gap between business and IT through prototyping – video
Audience network by Facebook
Symantec really needs to be made a example of. If there aren't serious consequences for this inability to create secure security products, companies will continue to get rich off of creating insecure software. Symantec fixed the bug this time but I doubt they will create more secure software in the future.
Great article, and good introduction to IOpipe. I think ultimately it will be nice to be able to run all of these FaaS (function as a service) platforms on Docker, to avoid cloud lock-in. I just can't imagine the industry supporting multiple proprietary platforms in the long term.
Exactly, I don't get this argument at all. I think the way Google handled the Symantec issue was just fine, but we don't need to live in a world where CA's need precrime units to clear someone for a cert. I do Nazi issuing Hitler a cert as a problem, anne frankly I don't think anyone should care.
> bet $1mm that S&P500 will outperform a hedge fund over a 10 year period.

He's actually betting against a portfolio of hedge funds going as far as to include fund of funds (typically a terrible bet). I assume he is only using US Equity hedge funds too?

I'd be interested to see the distribution of individual funds in his portfolio that beat the S&P vs those that didn't. In general though these numbers have huge survivor bias since numbers are self reporting and ignore dead funds.

It is also worth noting that the index went from 1400 to 900 over the course of 2008. So when he started the bet is clearly going to be relevant. You could of course repeat the experiment using every possible start date from, say, 2000 - though your portfolio of hedge funds will be hard to construct.

He is clearly winning, but it seems like an odd question to ask.
Do your strength checks in javascript client-side, then hash, then send. Server side can do further checks if it wants on the hashed password (hey, this password was already used, etc).
ThirdEye 4000i enables video surveillance over bonded cellular [pdf]
> The main point I think is, that GET Requests are logged in log-files which are usually accessible by more people that the main database.

This is an outright assumption, and it's a bad one.

This is a non-issue, because they do NOT log these requests, and it's https.

So move on, this is just noise.
React Native: Write Once, Run Anywhere?
Democracy has always been about the people being able to remove their leaders from power when they become egregiously bad. Kind of like evaporative cooling. The means by which they choose them is a second order consideration.
A TDD Approach to Building a Todo API Using Node.js and MongoDB
This hurts quite a bit because of the correlation it seems to be making between international students and cheating. I do agree that degrees should mean something, which means anyone benefiting from such 'cheating cartel' should not reap the fruits of being called a degree holder of an institution.

But a comment like this makes me wonder if this is how I am viewed as a non-citizen graduate of a 'good school' who performed well above average in their class. Credentials like a degree are never enough to prove someone's worth/skill, of course, but this comment seems to suggest I might be facing additional pressure to prove my worth because I'm foreign-born. I was not aware this might need to be something I should be cognizant of.
Sure. Peer reviews in pure math are often exceedingly careful, or so I am told (not in the field).

Still, I think it's a little much to say that it's "a community's way of saying a paper stands up." At best, it's the opinion of handful of people from that community.
I call bs! The whole scenario appears to have been concocted in the mind of this columnist. Who fires a bunch of interns for a dress code petition? If this is true (and that's a big if), methinks these interns are better off not working at such a place.
I discovered another way of getting contributors with Umbrella JS [1] (500+ stars), using up-for-grabs [2][3].

In total I'd say it's similar or even a bit more of effort per issue, however many people contribute and sometimes they step up and continue with more things.

Not sure how useful it is for projects that are more monolithic though, I was lucky with this one as Umbrella JS has many small modular parts.

[1] http://umbrellajs.com/

[2] http://up-for-grabs.net/

[3] https://github.com/umbrellajs/umbrella/issues?q=is%3Aissue+l...
I've heard it hurled at me, at friends of mine, and at other members of my community.
Does your request for confirmation incorporate the ancient HN discussion I linked?
A good place to start is the "How Evan Became a Phone Phreak" recordings. Though it's about someone dealing with electromechanical switching equipment in the seventies, it's surprisingly parallel to how a lot of people get into phones today.

Dialing Those Mysterious "1xx" and "0xx" Codes is another good one, as is the 052 conference.
> Thought experiment: Your product costs $50/month. Let's say you're the only employee. Do you think you could manage selling 100 subscriptions to reach "decent" profitability by yourself?

Don't forget support! You not only have to manage implementing features and selling your product, you also need to fix bugs and help customers who may not know how to do simple things.
Evernote limits free tier to two devices, raises prices 40%
> if someone really cared about a particular issue, the person would make an attempt at a pull request to help contribute

That's not always true. They may not have the necessary skills. That's no excuse for laziness in reporting problems though.
The ABC's of a Cyber Intrusion
Show HN: Wallarm – Protect your web apps or APIs with fast Nginx-based instances
Isn't the salt not necessarily supposed to be impossible for the attacker to find out though? like isn't it usually like the username, since it needs to be different for each user but not impossible for the server to figure out?
>There's no reason to expect the social forces that underly market returns will deliver the same returns in the future.

Except human nature is the same, economics is the same.
I had a non compete clause crossed out of a contract once. I was told they didn't usually change contracts, but they did.

I was also told 'it isn't usually enforced, there are plenty of people that have taken jobs at <only competition in the city>'. I said 'then it shouldn't be in there'.

Everything worked out for me but people need to remember a few things:

1. A contract is a negotiation/conversation/two way agreement. It is never a take or leave it offer in my experience.

2. Get the contract EARLY. Companies try to build momentum and act like a contract is a formality. Then they hand you something that takes away as much power from you as possible. They have lawyers, bargaining power, choice, time, experience, and a global view of salary that you might not. There is a huge imbalance of information.

3. If it is worth signing, it is probably worth having a lawyer take a look at it. A lawyer might bill at $250/hr. It might take 30-45 minutes to look through a contract and that can be a very worthwhile investment.

4. And of course, take the contract seriously. Don't sign something thinking the scenarios where it comes into play are too rare for you to care.
Type Anything – Test and create the perfect typography setup for your website
I personally like seeing the discussion in a public company channel and just set the culture so people know they are not required to join unless asked (but it keeps everyone on the same page). Just set some expectations around public conversations so people are on the same page. People can/will still have 1 on 1's outside the public channels when discussing a specific task etc, which is fine.

In the end though, this only scales so far, and then having specific channels for specific types of discussions and limiting the membership to those channels is important. e.g. business/marketing doesn't care about development except for timelines, so exclude them from dev channels etc. But for 5-10 people, you aren't at this point yet.
There are a lot of beginners who try to learn programming by using GH. They might not know how to make an example, or how to reproduce the bug by giving directions.

When I worked as a programmer, I had coworkers and other employees I worked with who couldn't tell me how to reproduce a bug, or give example code, and I had to train some other programmers in the language to help them learn more to work with a team. You can't just WONTFIC an issue, and yes it is harder to work that way.

You cannot block or ban people who are annoying or ignorant in a corporate environment. You have to find a way to help them out, by educating them, or just trying to fix the bug as best you can even if you can't reproduce it.

I made a debug version of the program that trapped for errors, and wrote them to a log file and displayed a custom error message so I can tell what part of the program it had the error in. You have to learn how to innovate and work with annoying and difficult people who don't even know they are annoying or difficult. Yeah it is stressful, but that is the difference between an open source project on Github, and working for an employer as an employee or contractor.
The mere existence of such a strict dress code should have been already a warning sign against petitions, but yeah a greenhorn could not know this - millennial or not. It's very true that businesses should not be equated with democracies.

Now, what would I have done instead? Quit, heck, I wouldn't even have interviewed there (although I'm older so cannot compare). First of all I value input from everybody INCLUDING interns and secondly if I don't want the customer to see butt cracks there's no need to require the whole company to wear matching suits (aka, there are much milder ways).
Hunspell Dictionaries for Rails
His bet is on returns net of fees. There are some theories that any alpha generated by a fund is eventually just captured in the fee structure.
> The EU can use the rest of UK to create an example, so no other country will leave in the future.

If the EU shows that the only way it can maintain unity is by punishing those who try to leave, many will leave.

They will absolutely not 'create an example' of the UK because that would amount to fueling the nationalist voices in France and the Netherlands. Even in Poland there are people who are now uncertain that they want to be in the EU.
The tech industry isn't zero-sum though, even from just a purely selfish "can I get a job" POV. More talent in the pool will arguably make the industry bigger, rather than diluting the value of that talent. There's just so much room to grow.
A lot of setups have one machine doing the SSL and then forwarding the requests over HTTP to backend servers which are logging the requests and would include GET parameters in the log file.
macOS Sierra and Gatekeeper Path Randomization
A good discussion of the item not long ago: https://news.ycombinator.com/item?id=10751450
It is far safer not to do it in the first place. I can easily see a new sys admin coming in and wondering where all the logs are for a url and enabling it.

Or they send their logs to an analytics firm. The firm says innocently enough "it doesn't look like we are getting all the logs" and then it is turned on.

There's a lot of ways a policy can be circumvented just because people were trying to do their jobs and didn't know better. Also it is highly unlikely that they have another process to confirm that they aren't logging that url
> Hillary rejects the false choice between privacy interests and keeping Americans safe. She was a proponent of the USA Freedom Act, and she supports Senator Mark Warner and Representative Mike McCaul’s idea for a national commission on digital security and encryption. This commission will work with the technology and public safety communities to address the needs of law enforcement, protect the privacy and security of all Americans that use technology, assess how innovation might point to new policy approaches, and advance our larger national security and global competitiveness interests.

Unsurprisingly, it's more Orwellian garbage.

To these "people", what's done at airports is security, even though it manifestly makes everyone less safe by separating us from our luggage, unpacking and displaying our stuff for all to see, stripping us of our tools, and creating a perfect chokepoint for the scene of their next 24 hour tragedy.

It's not surprising that captains of the private surveillance industry endorsed these policies, but individuals would have to be fools to think this means anything besides more regressive information totalitarianism.

(also, "Doesn't she look tired?")
If you want to know the returns for the next 7 years, GMO has quite a good track record, based on ratios being mean reverting http://www.gurufocus.com/news/349958/how-to-play-gmos-latest...