skysight-inc/HackerNews huggingface dataset:
There's nothing inherently wrong with exposing SSH on your production servers to the Internet. It is one of the most secure services that can run on any given host. Surely it's more secure than your web server or application daemon(s) which handle the other publicly-facing functions of your production host.

If you have the infrastructure and capability to put it on a different network by all means make it inaccessible but for most businesses there's really no other option anyway.

Simpler (better, IMHO) advice would be to make key-based authentication mandatory for your production servers. That way a brute force attack is unlikely to ever succeed. It also rules out stealing passwords since the attacker would need to obtain the entire SSH key before they could login.

Having said that, we don't know how the attacker got in. They could have created an account for themselves or changed the root password/system configuration via a vulnerability. If that's the case they could modify sshd_config so that it listens on the public IP which would make "don't expose it to the public" moot (firewalls notwithstanding).
Similar feedback, starting salaries seem about right, but beyond that seem low, the rating system isn't science and the CoL adjustment only for SF, NYC and London misses other expensive cities.

For instance, like for like (new construction in the most desirable neighborhoods), Boston housing is just as expensive as SF and in general your money goes further in SF.
Does Crime-Predicting Software Bias Judges? Unfortunately, There’s No Data
Ever heard of XDA?
I wish they also shared the salary of their managers. That's way more interesting..
Kind of what I expected, thank you for referencing SDCH. Directs me to more interesting reading material.

Edit:

Found this: https://aprescott.com/posts/sdch

Maybe SDCH isn't that useful after all? Looking to find some quantitative data on potential gains from SDCH now.
And the world doesn't even have to reach France's historic rate. Just getting anywhere close to it, and filling the gaps with wind, solar, and natgas, would be a overwhelming win for stopping CO2 production (and providing cheap and plentiful energy).
I got downloaded for asking Why. Seriously sad.
Maybe hire that person?
On some of the models you're describing the motherboard is soldered to the chassis, that makes changing the HDD a bit perileous.
Apart from that point I echo the sentiment. These are (were?) great little laptops for the price point/form factor
And somebody looked, so clearly the bounty worked! But the cost to find a bug has practically nothing to do with the impact of the bug. The incentive is to find bugs, not a particular world ending bug.
I don't mean this to sound like a negative argument against your points, but here's a positive spin on both of them:

1. This generally means it's easy to filter out candidates who aren't a fit for your organization. In my experience, most employers would love to have employees where the salary is not the first (or even top 3) factors in their decision to take a job. (Rare, I know.)

2a. That seems like a good tail into #1. The employees who aren't in it for the team/company/career filter themselves out.
2b. Or, it's used as a comparison for employees to better themselves. "I want Job xyz because I can make an additional $20k/year. How do I improve myself to get it?"
I think I'm going to be sick. Compensation for executives should be directly tied to company performance. You want to be at the top, then you should take the risk.
What should your company stop/start/continue doing?
To people focusing in on securing SSH: just because the person has SSH access doesn't mean that they got it through SSH. It's possible that they brute forced the password or whatever, but there's a ton of attack surface on a website and many ways they could have gotten access. If they got it through for example an XSS attack and got the SSH password/keys, securing SSH doesn't stop them from doing the same thing again.
The hardest problem in compute science: Naming
It's the same concept as auditors, there's the big 4 that you've probably heard of, and a ton of other, smaller firms with varying quality.

You could go with a known firm like iSec Partners, Matasano (now NCC) or Mitnick Security. They won't be cheap - at worst they may be able to refer you to some other reputable firm if your budget is limited.
I humbly sit corrected. Thanks for the links!
I don't have too much knowledge of ARM, but from what I hear the errata are surprisingly few in number (compared to say, an x86 cpu).

Also, that is not to say companies like ARM are only recently verifying their chips. This is only in regards to formal validation, which others have explained the circumstances of pretty well. There are still entire teams dedicated to code and functional validation.
You assume the breach happened over SSH. This is valuable information to securing SSH, but it's entirely possible the original breach happened over some other service, and there were some other steps involved in the breach before the SSH screenshot was taken.
Supply and demand?

Even if skilled SREs aren't as common as full-stack developers, it could be that so many more full-stack developers are required industry wide that companies have to compete harder on compensation for the best ones.
For some local fleet jobs you can probably put batteries in the trailers (if the cargo is consistently not super heavy).
How to Create a Awesome Semi Automated Budget
How easy is it to migrate from Laspass to 1Password? I've had the worst experience with their tech support (reported 2 bugs that have both been scrapped as WONT FIX) and really don't want to support them as a premium subscriber anymore.
>I have been using MI phoneS for more than 2 years Now

But why?
The Decline of British English, Visualized
Human population is already leveling off. The richer a people become, the lower their reproduction rate. The lack of population growth has already become a major economic issue in many parts of the world.

And we have, for all current intents and purposes, an infinite supply of nuclear, solar, and wind energy.
Keep in mind though that while securing SSH is a good approach, SSH itself is very unlikely to be the route of compromise unless an extremely insecure account were present with weak password auth.

It's far more likely that the attacker got legit credentials via another means, web application vulnerability, social engineering or malware attack on company machines, etc. I'd look at the less common applications you run, particularly anything that doesn't particularly look like it was designed to run facing the internet. For example, the elasticsearch guys decided that it would be a great idea to allow anyone who can access it to run java code on the server at one point...
> 2. Internal employees - Stack Overflow said this has been available internally for a bit, but when employees find out what others are making they are inclined to compare their own efforts/abilities vs others. It can lead to people either asking for raises to match their co-workers, or perhaps feeling slighted and seeking other employers.

Why is this wrong? The labor market should strive to be efficient, no?
Of course, Sloot might have managed to come up with a nice dictionary of chunks of binary that are common across lots of videos which might have been useful.
Just to add another link to the pile, the most useful database I've found of base salaries for comparison is the publicly available H1B data. You should account for the costs to the company of sponsorship in addition to the base.

The data is available down to the company and title:
http://www.h1bdata.info/
Also, you thank the reporter profusely for doing the right thing.
An epidemic you say, doctor?

Mostly I liked how you reconciled your personal pains with your expert domain knowledge about human biomechanics and health to provide medical advice, even providing Googled images that unequivocally demonstrate your claim and truly the extent of this epidemic.

Sorry your arms hurt.
Which part are you disagreeing with? The fact that Pokémon Go is not that interesting technically is exactly that person's point. And yes, I too suspect that there will be hundreds of me-too AR games now that Pokémon is such a phenomenon.
It's easier to move a couch when no one is sitting on it.
"There is no paper number six!"
When you are here, is 1password for team is the future and the classic 1password will become obsolete soon?
The 1-5 rating system is where personal judgement/responsibility come into play. If I were a very good developer but poor at negotiations, I would find this system to be the opposite of demoralizing.
We looked at financing through some of those new 'hip' lenders. My wife works for Google and SoFi had some of the highest rates (even with 'Google discount' and 10/20% down). They may get your pre-approval within a day, but in reality most lenders get that done quickly. In the end, they have to play the game everyone else is playing and it means long turnaround times to actually close. This is the part that is fundamentally broken and really in need of 'disruption'.
Came here to say this. At minimum, an SRE is worth at least as much as a developer - and frankly, are probably worth more.
Has Netflix lost its prestige?
That pic over the pyramids is stunningly beautiful. Hopefully this achievement opens more eyes.
Including vocative address?
> I don't know what braking systems these will use

Er… regenerative? Short of emergency braking which should almost never be necessary in city traffic.
Personally ,the worst I've ever run into is some hairy classpath issue, as one the children comments mentions. Although maybe I'm just lucky.

Where does bytecode manipulation or code generation happen in Dropwizard? Reflection for sure, but not any more so than any major web framework in a dynamically typed language.

Maybe you're referring to the SQL library they suggest (which I've admittedly never used heavily). But I don't see how you can have a SQL library without generating SQL.
True but I'm working from the angle that If the breach happened via some other means then they'd need some way to remotely execute code to enable SSH, create valid login credentials, and disable the firewall; in which case they already have a more convenient shell access so gaining access to SSH becomes redundant.

However it's possible that the attacker's screenshot was of a remote shell initiated via some other means and the OP assumed it was via SSH.

Edit: why was this downvoted? If there's an error then I need to be educated. I've spent enough years of my professional life hardening servers to have some idea what I'm talking about, but I'd be an idiot if I didn't listen to the expertise of others. So please correct me rather than downvote me :)
There's nothing in the OPs post suggesting SSH was exposed to the public, or that the breach happened over SSH. So it's important to secure that, but it's also important to think holistically about the attack surface.
The worst thing about Xiaomi is their invasive software. In order to use a Mi Fit band you have to create an account with them and grant their app every permission under the sun.

I love their hardware, it's a frugal premium grade that's hard to come by. I just wish it were more open and their software wasn't so questionable.
Microsoft has been known to use Embrace-Extend-Extinguish as a strategy. So this means nothing.

https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish
Well was that with Apple products?
OS X nudges past Linux for me because it is much more efficient (this is what I was alluding to in my statement about hardware and software working together). If Linux could work out some way of being just as efficient with the battery as OS X, I would put Linux on my laptop instead of keeping it only on my server.
Trucks often have associated warehouses or depots that could support centralized battery charging facilities. For cars you are lucky if the owner has a garage that can fit a car.
This is unacceptable. She sold off a big chunk of Yahoo (that she could not resurrect) to Verizon where most of the staff is eventually going to get axed and she walks off with $122 Million. There has to be checks and balances somewhere. Tech industry is turning into dirty Wall Street.
Or we would see climate change leaders of the world driving armadas of vehicles, flying legions of people to their conferences, living in mansions, using the carbon footprint of a medium sized city, all while preaching we, the little people, need to put on a sweater in the winter and sweat more in the summer.
It gives ~£65K for a non-London developer, with zero experience and skill.

Looking at the average for that around here being £20K, I'd suggest it's really well off the mark unless you're in Silicon Valley.
In my experience as a hiring manager, it was a lot easier to find qualified developers than it was SREs or similar. Plenty of people doing ops work, but not a lot of them at the senior level. And the senior ops people we find demanded, rightfully, much higher salaries than the developers.
I have the exact opposite reaction. I find android lacking in many ways, even though i sorely miss killer apps, such as termux, and the general openess on ios.

Being a 90% linux vs 10% macos kind of guy, it feels a bit weird to promote the ios UX, but I guess it emphasizes the fact that people might be inconsistent in their likings, hence the need for choice.
A competent developer with 10 years experience at less than $60k gross?! I imagine any sized company in any location in the US would hire that person in a heartbeat. If you are a productive developer in a common programming language with 10 years experience, you have decent communication skills, and are able to work in a team, earning less than $60k -- then you are significantly underpaid.
Ask HN: What have your RSU grant refreshers been?
I work for a fortune 10 company with 5 years of experience in the valley as a level 3 engineer. I had a initial grant of 100k followed by a refresher for 80k. I am trying to figure out what should I ask for this year.
Show HN: Digit – learn Git by visualizing it
Do not trust random HN or serverfault answers.

Cleanly shutting down the server can trigger rootkits that might wipe evidence: talk to a professional.
Pulling the plug can still remove the ability to observe the behavior of the attacker: talk to a professional.
Touching the disks can expose you to the risk of being accused of tampering evidence: talk to a professional.
Human nature whether it be man or woman.
That requires special trailers and tractors rather than just electrical tractors able to handle any standard trailer.

It also requires much heavier and "non-standard" coupling between tractor and trailer since the trailer now needs to power the tractor rather than the reverse (and needs send significantly more power over the link)
It's a good idea to be doing mirroring anyway if your business depends on it. Otherwise the original repo disappearing (or corrupted otherwise) or network going down is going to hit your productivity. And things are faster with mirroring.

And yes, it's annoying, but a workaround exists.
Of course the curve will remain centered about 100, because that's how IQ is defined.
Have you seen the stock? Wallstreet should be grateful.
Yes lots of alternatives, you can argue that there is an alternative for virtually everything that is available if you are willing and know how to find it.

This is the same argument that Windows Phone (ironically) make, but most people want the same programs that all of their friends run. Computers and most other electronics are appliances to most people they just want them to work without any thought.
Do you have any suggestions for products/tools that can handle multi-gig streaming datasets?
Don't forget having more than 2 weeks of holiday a year.

I could cope with 50-60 hours a week. I could not cope with only one proper holiday a year.
Seems like the sort of problem a deep neural network would be great for. I've already got some good hardware for it, but I'm a little apprehensive about acquiring enough training examples.
the more money you've got, the cheaper it is to get more. money follows economies of scale.
That people are starving to death, die in an epidemic or kill each other is all my fault.
Company performance has improved since she got there, check out the stock.
So she does know how to negotiate, it just has to be for her personal gain.

> Yahoo is also paying to help Mayer land a new job. During her period of transition, Mayer will presumably need office space, and someone needs to pay for it. The company will put up $15,000 for 24 months of outplacement services for Mayer.

> Mayer is entitled to receive her base salary, which in 2015 was $1 million, for two years after she leaves the company.

Clearly she set the same "you get your salary for 2 years after leaving" + office space package up for all the developers in the company...
I have to say my favorite part is how they have to pay her health insurance premiums ($2k/month) for 2 years.

I need to up my negotiation game. :)

Plus, 2k a month? I can't even imagine what amazing Super Platinum plan she must have.
There is not enough light to power probes after a certain distance. That's why they have to use the RTG's in mission like New Horizons. There was also a shortage of the Radioactive material to make the RTGs, but that seams to be solved with NASA producing its own material.
The advantage of a "single payer" system would be to bring the benefits of large corporation negotiating power down to everyone.

If there was no competition at all, I'm sure that there is some potential for rising costs. But a lot of "single payer" systems actually do offer a fair bit of wiggle room for private market competition. The mess that is the state of the United States government health care really isn't a compelling argument here against single payer (the statistics for most of the rest of the world's health care systems, which are more integrated, kind of show this). I would expect that any "Medicaid / Medicare for all" system emerge in the United States would be two-tiered, like is the case in several other countries.

To be honest, I would almost describe the situation in America as oligopoly-like in many cases (in insurance and hospital networks in particular) depending on where you are, and that would mute the effect of any corporate competition.
TLDR; (fta)

Alice and Bob should each
learn the logical AND of their
responses, and nobody should
learn any other information

The SENPAI protocol is proposing a way to do this with cryptography. There's a historical review of other proposed protocols (AMP, JMAP, MFP, SOAP, YGMP, SLP) along with their deficiencies. A SENPAI-MTT protocol is also considered that allows for non-binary interest (MTT=More Than Two). They propose foiling protocol cracking by quantum factoring by basing future SENPAI protocols on lattice based cryptographic methods.
Indeed, however some of my points still secure against that:

1. firewalling to only the sysadmin's IPs,

2. SSH keys + disabling password logins

6. and disabling SSH on internet facing IPs altogether (if possible).
My starting salary was higher than your 10 year experience salary. You are WAY off the grid, even with quality-of-life arguments factored in. Unless you work less than 30 hours a week, you ARE getting ripped off. I don't know anyone who started with less than 60k other than my brother who was 3rd man in at a bootstrapped startup. If you enjoy your job, awesome. However, you're very easily in the bottom half of starting salaries if not lower.
> Just because trucks don't need to have a down time for sleeping like a car with a single owner does?

That, and trucks generally go back to depots regularly to load/unload/etc… Even more so if you're swapping tractors around cities, you'd have swapping depots for that purpose.
but where though?
Sigh. There was a story just yesterday or maybe slightly older in WSJ about "short list of well paying jobs" and the only thing I remember was that every second word was "manager".
Not for Valve.
Como Escrever Uma Newsletter Bem-Sucedida
I suspect a considerable portion can be attributed to FOMO (Fear Of Missing Out). Whether it's that new Netflix show, some snapchat celebrity, watching the news, getting stuck in a Wikipedia hole, or going out with people after working 11 hours. People will burn hours a day on these things.

My wife is guilty of the Netflix and News descriptors mentioned above. I avoid the news and prefer to read but I still get stuck in the "one more chapter" hole.

I am curious to know the breakdown of sleeping habits based on some simple personality distinguishers like introvert vs extrovert.
Great point. Exactly the type of comments I come to hacker-news for!
Knightmare: A Devops Cautionary Tale (2014)
When you get hired to save a dying company, you shouldn't be slammed for the stock doubling.
Why does it need to be so thin? I don't really understand this fad of making every so thin that battery life suffers.
oh yeah if they would already enforce current regulations on emissions of these big ship (freighters, cruise, all of them) in international waters. Now they only have to be efficient, low emission near ports for example.
> Linux has tons of native applications in just about every category.

Cool. Where's Word, Tinder, Instagram, Google Maps, Google Mail, Outlook and WhatsApp?

I think there's a Linux Spotify, so you've got that.

I love Linux (I'm ex Red Hat and IBM's Linux team) but Linux (as mentioned, Linux/glibc/X/whatever) lacks apps.

> Is that a troll?

Seriously?
Disclosure: I also work for AgileBits :)

We have a dedicated LastPass import option. See here:

https://support.1password.com/import-lastpass/

If you encounter any trouble please write into support at agilebits dot com and mention "Kyle" somewhere in the body of the email and I'll get notified. You should be fine though, but every once in awhile we have someone encounter trouble with the import from LastPass.
I wonder which lucky company will hook her up now....
Her compensation was directly tied to company performance. 96% of her compensation was in ownership share in the company. That ownership share is worth $117M because the stock went from $15 to $39 per share while she was the CEO. If the company had tanked instead, her compensation would be less. Considering the outlook for Yahoo!'s core business was so bleak at the time she was hired, who's to say this wasn't one of the better outcomes for the board that hired her? Yahoo! returning to its glory days as a tech giant was pretty unlikely.
Factoring customer lifetime value into e-commerce marketing planning
If autofill is potentially so dangerous, and in this instance, the prerequisite setting for this to work, why should it even be a feature?

People who enable it might not understand the repercussions.

I use 1Password and always invoke a shortcut to fill in my credentials.
I can only speak for myself.

But using the most simple and correct abstraction to solve a problem makes programming much more fun.

For example, components are easier to work with than MVC.

Or reactive programming made taming realtime data streams much easier for me, than imperative programming.
And? Note that I didn't propose it as the likely universal future, just as a potential way to do battery swaps.
Hire someone because they exploited a single vulnerability?
The Encryption Debate: All Quiet on the Western Front?