skysight-inc/HackerNews huggingface dataset:
Well, if it relied on just that then that would be accurate. It also relies on the specific architecture and registers available and the calling conventions of the target format (which use different numbers of registers for function arguments).
and Fable for F#
https://github.com/fsprojects/Fable
Yes, current nightlies are 1.12. Anything can happen before release, though, so in theory, it's not guaranteed to land in 1.12 until the day that 1.12 forks off from master.
The most outspoken anti-Wikileaks people are (in my experience) typically those who hold a security clearance and work for the government or law enforcement in some way. I don't understand their mentality, but I think a lot of them have a sense of patriotism and nationalism working for the government. Therefore, they feel like they're on the opposing side of Wikileaks, and Wikileaks broke all of the rules they've been so dutifully trained to follow, and so naturally they feel threatened by Wikileaks.
> $3100 is still a high amount. How would this be any different for a couple to rent an (equally sized) apartment with another couple for the same amount? That price makes sense for the area.

That's equally asinine. Arguably, even more so if both couples are sharing one bathroom.
It's an enormously harder problem to convince the customer to push the "update firmware" button on the front panel than it is to insert malware remotely without any action or knowledge on the customer's part.
ProjectSuaron: Kaspersky Lab researchers describe espionage platform
"I’ve found that the definition is more useful to both developers and managers when it encompasses all debt of a technical nature."

Isn't this the definition that everyone uses?
> But if the syntax is wrong, it shouldn't try to fix it or guess what the user meant, just display an error. Accepting invalid syntax means all HTML parsing becomes vastly more complicated.

Why push the complexity onto the user? Someone who just wants to make a working website doesn't care about your pedantry.

Do they want their page to fail to render entirely when PHP outputs a warning? Do they want their website to be completely broken because they forgot to convert some of their text from Latin-1 to UTF-8 before pasting it into the document? Should we really expect them to have to modify their blogging software to validate custom HTML snippets, lest the entire page become unusable? Will they be pleased when their style of code falls out of favour in future, is deprecated, and then their page doesn't work at all later?

Moreover, strictness can backfire when you have such a diversity of implementations.

> Which creates room for bugs, exploits, and unexpected situations like OP's post.

The OP is not so much an unexpected situation as a carefully engineered one that's completely within the constraints HTML sets.
Mapping NYC Transit. All of It
Good post. I was just asked to set up retrospectives for my Team (I'm a new team lead) and was just asking myself what the heck I needed to do. This write up is just what I needed. Is this something that is done once a sprint? Or is it more on an "As Needed" basis?
For C++ APIs, "API Design for C++" from Martin Reddy:

http://www.apibook.com/blog/
this this this this this this

I cannot recommend this book enough. Read it, read it again, take in everything it is trying to say and try as hard as you can to understand it.

There is a whole world of awesome and tragically misunderstood tools in the book.
States win the right to limit municipal broadband, beating FCC in court
I watch out for people complaining about things, but don't treat it as a negative. It shows that at least they care enough to complain. The situation is far worse if they give up complaining, because they no longer care. Complaining also implies there are improvements that could be made, so again a benefit.

This attitude surprised someone the other day complaining about their code. I was delighted, since it meant they cared!
The concern, I think, is that all the leaf nodes outside of your direct control also need to be secure. All the nurses, doctors, and other caregivers with access to the system need to be prevented from exposing that data. Is it possible for that data to end up on USB drive? A laptop? Sent in plaintext anywhere? etc.

The protection needs to be automatic. Training people is a "good intentions" solution, and will always result in failures. It should be mechanically impossible for the data to escape in a way you do not approve of.
Though it's somewhat dated and C# oriented, the really, really fantastic Framework Design Guidelines by Brad Abrams and Krzysztof Cwalina is a thoughtful treatise on designing usable APIs. A lot of the things I read in there still resonate with me almost a decade later.

https://www.amazon.co.uk/Framework-Design-Guidelines-Convent...
There's a lot that can go wrong if an attacker has physical access to your device.

As far as is publicly known, you're not directly vulnerable to having the password broken as long as the device is powered off when it falls into the wrong hands, but there are a lot of caveats. If it's powered on they can possibly extract the password from RAM using a "cold boot attack". They can also freeze the RAM to get its contents to last longer and then moving it to another computer and dump it, recovering your full-disk encryption key.

If the attacker has temporary physical access, they have a number of ways that they can tamper with the device. For example, they can replace the BIOS, the bootloader, the firmware on your keyboard, etc. The new code can record your passwords or send your data to the attacker over the internet.

One other way that you're physically vulnerable is that the attacker can possibly infect your hardware before it even arrives at your home, by replacing hardware while it's shipping. This is probably only available to nation-states.
Oh, I see.

As others have pointed out, very unlikely he could be done for treason given he isn't American. But let's not let facts get in the way of some good down voting.
Depends on how the language runtime defines its calling convention, does it follow System Linkage [1] or does it implement its own internal linkage ie Private Linkage?

If it follows standard System Linkage, its easy to point gdb or any other system debugger or profiler to debug and profile the application.

Some runtimes have a mix of System and Private linkage, ie C functions will follow System Linkage but JIT'ed code frames might follow private linkage. This makes for difficult stack-walking by system native debuggers and profilers. You'd have to teach GDB via an extension how to walk the non-standard frames.

So yea, long story short, it depends on the linkage convention the implementers of the language runtime decided to follow.

[1] http://www.x86-64.org/documentation/abi.pdf
Yes, they changed the system. Now you can return games in the first two weeks if not played more than two hours. See http://store.steampowered.com/steam_refunds.
I think people should be able to sue companies that do this. They surely did not advertise it as "secure unless we lose the key". Having a backdoor in the first place could be counted as negligent (should be counted as outright fraud).
I asked myself this a couple of months back. Here's what I found http://harrymoreno.com/2016/03/31/API-design-link-roundup.ht...
Well I don't know about hacker news, but there is a study that says anger is the most viral feeling in social media, e.g. twitter.

http://arxiv.org/pdf/1309.2402v1.pdf
The query engine doesn't support sharding. You're starting with a straightforward relational database and ending up with a bunch of fragments of relations that must only be used with great caution because most joins quietly give incorrect results.
Ask HN: Can you share how is it like to own a Tesla vehicle?
My idea is get rid of minutes and text and simply have data on your phone. Then you can use the call/sms service of your choice to provide those features over https. Basically unbundle the whole deal. The carriers would never go for it but I think it would work.
Great question! For Microsoft's HealthVault, patient would have to gather the records themselves AND enter the information into HealthVault manually.

We make it super easy for patients to gather their medical information and make it even easier to manage (share with physicians, family members etc.) their information.
Just to add to what you're saying... Even most security guards dislike bully security guards as much as you do. It's all about the power trip, and nobody likes a person abusing their authority, especially if that authority is simply perceived and not real.
This is a great point. As a MD I don't think the process of asking a patient his/her past medical history will every go away. It clarifies how the patient thinks about their medical problems and develops a good rapport.

But as you allude to, having a summary of pertinent medical information, compiled from patient records located in various hospitals, would be enormously valuable for a doctor seeing a new patient. For example, your emergency room doctor having a one page summary of your medical information to be reviewed quickly in an emergency.
That looks like quite a bit of hype for someone who has not done too much as of late.

Cracking the iphone was great, but disparaging top notch organizations (Carnege, Tesla, Vicarious, etc.) sounds more like narcissism than reality.
I'm quite new to a lot of the concepts in Rust, and while many error messages are simply infuriatingly confusing.. there are many that are extremely helpful.

Hell, just the underline showing you what area is wrong really helps you spend the fewest cycles on simple typos and etc. It's really a joy.

Fwiw, the frustrating times are usually involving some semi-obscure type system issue i've caused. But seeing as i'm probably their target user for these sort of messages (beginner), i guess my issues are still probably relevant.
Fair feedback re: comms on website.

The OkHi approach is use your phone number as your universal key to share your address (with obvious privacy controls in place to control who can access it). The address itself is a GPS point + a photo - you can see an example at http://okhi.co/hq (best viewed on mobile - this is a vanity url, but you could very much imagine it eventually being something like okhi.co/+254/700111222).

The OkHi business model (similar to other companies in the space) is to allow consumers to share these addresses peer-to-peer free and charge per-use businesses who work in logistics or need address data (e.g. food delivery, ecommerce, emergency services, banks, postal services). They collect the base address data that users can choose where they live from through our own on-the-ground data collection or smartly crowdsourced data (surprisingly scalable).

Lots of promising progress, though obviously lots of work left to make it global. While it is easier to build a business controling the full stack, over time, the base addressing data could become open-sourced/ user address data stored in a public open db e.g. blockchain. I think the issues folks bring up of open-source benefits are very much in mind as this sort of system is built.
> That is exactly what some people do in real life professionally in phycology,

I didn't know that algae responded so well to honesty.

Assuming that you meant psychology, there's a huge difference between hearing something from a professional psychologist and from a friend. It's a whole different relationship, with different words. If a friend treated me like a patient, they'd stop being a friend.
I'm not part of the FreeBSD Security Team any more (I stepped down as Security Officer a few years ago because I was no longer able to find time to do both that and Tarsnap, and last year I left the security team entirely when the team was pruned of its not-recently-active members), but some comments based on my experience:

1. If there's an exploit circulating "in the wild" then yes, obviously, an issue should be publicly disclosed. (I did this with an rtld bug in December 2009, circulating a "quick patch" about 48 hours before we had the advisory and binary updates available.) The only exploit I've seen circulating recently was for the issue fixed in FreeBSD-SA-16:25.bspatch.

2. The boilerplate updating instructions in FreeBSD-SA-16:25.bspatch should have been amended to remove the use of bspatch. Unfortunately I didn't see the advisory text until it went out. (For reference: Adding ": > /usr/bin/bspatch" before running freebsd-update would solve this; freebsd-update would fall back to downloading complete files rather than using patches, and one of those files would be the corrected bspatch binary.)

3. I'm sure it was never the intention to leave vulnerabilities unfixed. But we've also learned to be cautious about adopting patches which are "thrown over the wall" at us; one source in particular had roughly equal odds of "doesn't fix the vulnerability", "fixes the vulnerability", "fixes the vulnerability but breaks functionality", and "introduces a new vulnerability which is worse than the one being fixed". So the approach was normally (and I assume still is) to look through a patch and ask "what does this change fix?" and take the changes which we can identify a purpose for.
Any good online courses?
From the 2009 study in the article:

"Half the students were asked to recall something which had irritated them and write a short essay about it. The other half of the group were made to feel sad."

So the "better" performing group was angry and did something about it. While the control group was made to feel sad. Not neutral. Not happy. Not optimistic. Hm.
Well, just anecdotally, blunt or angry contrarian responses seem to be downvoted in most online communities.
>If an attacker has physical access to your device, you're already screwed.

The FBI had physical access to the San Bernardino iPhone. If this were true, what was the point of the public fight with Apple and eventual purchase of a zero day exploit to get into it?
You don't have to prove the study wrong, you just have to be cognizant of this:

THESE ARE ALL JUST NARRATIVES.

Sure, they found some studies on the subject of anger and creativity. Does this mean that "bad-tempered people earn more and live longer"? Fuck, no.

First of all, this was never what was being studied. Second of all, what the hell is "bad-tempered"?

It's all "just a guess". The act of going from observation (the behavior of a bunch of students in a study) to the abstraction (anger helps you live longer) is necessarily an act of intuition. You can accept it or not, as you like. If you decide the evidence is compelling, go for it - live your life by swearing at people.

But you're just as free to say, "This evidence is bullshit, and it's a great stretch to say that it has general implications about the impacts of anger-management on health and success." There is no one to tell you otherwise.

The unfortunate problem with this, and other articles in this vein, is the pretense that we have arrived at some idea of the "truth" based on "evidence", as if either of these things existed, and we should all start living on the basis of this paradigm. There is only ever observation (itself a fraught enterprise) and subjective interpretation.
"Pleasing people most definitely pays. That is how the world works; you give people what they want, and you get paid. Supply and demand." <-- That might sound mature and sophisticated, but it's actually a fairly naive perspective. Superficially, yeah, sucking up and giving people what they want (vs. what they need) will pay. At least in the short-term. However, over many iterations of this, the payoff becomes less and less.

"Talking about truth and white lie as a dichotomy is childish. They are tools in a toolbox. If you feel guilty because you lied, then you are a slave to the principle of honesty." <-- that's a fairly immature perspective. You're conflating honesty with integrity or authenticity.

Integrity is wholeness of being, and it includes all of a person. It includes both the parts that will lie, cheat and steal as well as the part that wants to be honest and upfront. Integrity requires awareness and mindfulness.

What you're describing in your comment is on the psychopathy spectrum, which in and of itself is not necessarily a bad thing. However, this is not the end-all, be-all of human consciousness, and there is a lot more room to grow from there.
Sydney startup Bigstone raises $3M only six weeks after launching
Spaceplan
Dave Winer: Fat Protocols and Venture Capital
How a small Florida town is standing in the way of stopping Zika in the US
~1,500 enterprise technology funding rounds, dating back to Summer 2011
Maybe the other person in the pair is forgetting to use their tools because they are stressed out by the aggressive person standing over their shoulder looking for any excuse to grab the keyboard?
> I suppose if you were wanted for questioning by police for a serious crime that you wanted to evade and you hadn't got a friendly government seeking positive news coverage to give you a legal loophole to remain at large, you might.

There is so much wrong with this, and I suspect you know this, so I am probably wasting my time replying.

>serious crime

I am not sure a he-said/she-said argument about whether someone used a condom is a "serious crime". It's a shitty thing to do obviously but a "serious crime" it is not. The chief public prosecutor even said "I don't think there is reason to suspect that he has committed rape." and three of the four allegations made against him have been dropped.

>that you wanted to evade

Suggesting he actually did the crime. There are only allegations, and coming from a place of questionable integrity.

Additionally, he's not evading any alleged sexual crime, he's evading being extradited and facing capital punishment for political reasons. The UN itself had said his detention was in violation of international law, and Sweden said to uphold the warrant anyway.
Commit privs in two large open source projects. About 50000 lines of C. And, as you can see, touchy about things that look like armchair criticism.
Off on a tangent, I find myself wondering if I'd have a higher opinion of Hugh Grant's acting if he did roles closer to his real mood. He needs to consider following in the footsteps of another Hugh: Lawrie as Dr. House.
Fireup is on ProductHunt
a home-made public key signature format instead of PGP

How is 'openssl rsautl -sign' a "home-made" signature format?

As for using GPG... given its security track record, that's one of the last things I'd want to consider using for verifying signatures on binary updates.

or not using signatures at all for package files

The pkg repository is signed.
This has been around for a couple of years and the wiki is kind of dead, as seems to be most of the project looking at the activity around it? This probably warrants a (2011) update to the title as it seems that's when this project was truly active.
Better phrasing: how do you pick up contracting work if you have absolutely no connections?

I'm not a particularly social person: I mostly just like staying home and working on coding projects in my off-hours. I didn't made friends or "expand my network" at my last few jobs; I just showed up, did work, and went home.

People always say "do contracting to save up money if you want to do a startup", but I have no idea how to get off the ground. I certainly have a lot of skills, but I'm not sure who I could possibly sell them to.

Is this when I just start cold-calling? I get the sense that nobody on HN is ever really bothering with inbound marketing for contracting services; I constantly see "programming talent is a seller's market" and "just use your network", but never anything about running ads for your services or anything.
How then can others be warned about abusive - and in the case of amazon they were abusive[1]- past employers?

[1] FWIW, I've had some bad jobs, usually because they were startups where people didn't know what they were doing. Well meaning people in over their heads can be tough but fun and the furthest things from abusive. Amazon was organized to abuse employees as a consequence of protecting management egos.
Sedgewick's Algorithms in C++.

I am a non CS guy who learnt C++ programming in order to do simulation for my final year project in mechanical engineering. I ended up creating a wonderful GUI (MFC) simulation complete with the diagram of the engine etc. For the next 5 years or so as a freelancer developer assisting professors and the like, I created pretty hot shot applications with nifty graphics, UI etc. I began to see myself as a master programmer and thought how easy it is for CS guys compared to Mech guys. Then I picked up this book. I had never known any of what it talked about. The very first example of union find was a revelation. My ego was completely thrashed. I was thoroughly humbled.

As for non technical, it would be The Count of Monte Cristo. I first read an abridged version of it as part of high school curriculum. As a young teen, I was instantly enamored by revenge and adventure. I still long to own a yacht and sail the oceans, if not get imprisoned, or find a treasure, or kill people. I am reading it again at bedtime and Dantes just got locked up at Chateau d'if.
This is exactly what I have been looking for! I wonder whether this is all NLP or it's a combination of NLP and operators?
Never used it but it seems like a plausible project; it has Google's infinite $$$ backing it and smart people like Gilad Bracha on the team. They've built up quite a lot (language, tools, package-manager, IDE, ...) from scratch which is pretty impressive.

As a language, it seems pleasant: somewhere around C#, a mix of JS and Java, less "powerful" (or less "crazy" depending on how you look at it) than Scala. I think I personally prefer Scala, but wouldn't complain too loudly if I had to use Dart/Dart instead of Javascript/PHP.

On the other hand, even with Google's backing they seem to not have managed to aggregate as much of an ecosystem in the 4 years they've been available. In particular, server-side-Dart hasn't really taken off, and client-side dart doesn't seem to be that popular compared to say Coffeescript or Typescript or even Clojurescript.

I think the advantage of Scala.js over dart is that we only need to build the JS side of things: there's already a pretty large server-side Scala ecosystem. There's already all the tooling and IDEs set up. There's already the community of people who already know Scala, and do not need to re-learn anything.

Thus even though the Dart-JS ecosystem is probably not that much smaller than the Scala-JS ecosystem, I think Scala-JS is a lot more viable and sustainable (since it can piggy-back on all the Scala-JVM stuff) while Dart-JS and many other new-language communities have a tough struggle to gain enough critical-mass to be self-sustaining
I'm actually a bit confused about how this is a "golden key" problem (if I understand what that means).

As far as I can tell, the problem here is that there's a signed policy that was intended for newer versions of Windows, but is also interpreted by older versions of Windows as a valid policy with a different meaning. On Win10 1607 it means "under such-and-such conditions, merge these additional rules into the already applied policy" and on older Windows it just means "apply this policy".

But the only key here in both cases is Microsoft's regular signing key. Which I guess could be considered a kind of golden key/backdoor/whatever in itself - just as in the recent Apple vs. FBI standoff you could say the fact that Apple had the technical ability to sign and install a hacked OS was a backdoor to begin with - but that doesn't seem to be what people mean.
ImageNet classification with Python and Keras