skysight-inc/HackerNews huggingface dataset:
It's easy for us to sit here and type how he was bullied and he should have stood up more for himself...when we weren't the ones in the situation. He calmed down and made clear-headed decisions about his next move(s). It was the right move.
Previously, on HN:

https://news.ycombinator.com/item?id=4209052
Looks great! Any plans to document the synchronization protocol?

I've been using SyncThing but it lacks the main feature I need, which is to selectively synchronize only certain files to other devices.
What does leaking your private key have to do with backdoor keys? Isn't this like saying that CAs are backdoored because somewhere there exists a private key for those certs?
I felt Google was much easier to get started in than AWS. And it's easy to forget that it's quite possibly the most complicated system most people who use it interact with. It probably has a few magnitudes more expressive power of a, say, a webpack+babel+package.config (yeah, hard to measure, I know). And that's a competition it easily wins.
> The Register understands that this debug-mode policy was accidentally shipped on retail devices, and discovered by curious minds including Slip and MY123.

> The policy was effectively inert and deactivated on these products but present nonetheless.

Whenever I read things like this, I always envision that it's not a cock-up at all, but instead a deliberate effort by righteous free software-minded people who happen to work at Microsoft and are dismayed by the things they're asked to do.

But that is probably because I wish it so.
> I think this is a fair bit different than being lenient on HTML interpretation.

It's not. There are two areas where the leniency was a problem here. Firstly, the leniency in rendering one media type as a completely different media type because the browser heuristic thought it was being lenient. Secondly, the leniency in parsing HTML out of an image file – you can't do that with valid HTML.

> Accepting malformed HTML doesn't seem to pose much of a problem.

I've literally just given three specific examples of it causing security vulnerabilities.

> This doesn't sound like being lenient. This just sounds like a bug.

No, it was intentional. It was specifically Unicode characters that looked like less than and greater than signs, but weren't.

> I don't understand the scenario being described here.

Somebody noticed that href="java\nscript:…" wasn't being parsed as JavaScript, and it was causing some malformed pages to fail to work properly. Rather than let it fail, they tried to fix it by stripping out the whitespace, and caused a security vulnerability.

If these three examples aren't enough, take a look at OWASP's XSS filter evasion cheat sheet. There's plenty of examples in there of lenient parsing causing security problems:

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_She...
App Engine Flexible runs on GCE instances, which all have internal IPs. So you can just firewall off external traffic but allow internal, which is the default anyway.

Disclosure: Also GCP Developer Relations
Ok well how about you go out there and pick a fight with that security guard instead of typing about it on the Internet. It's real easy to say stuff like this when you weren't the one in the situation and it's not your life that's on the line.
I managed to miss it! FAIL.

Based on what you wrote, Chicken is out - I want reentrant.

...

I got Gambit to compile, simple expressions appear to work - but I cannot figure out how to compile them to a binary executable.

cat t.scheme
(define Hello "Hello")
gsc t.scheme
file t.o1
t.o1: ELF 32-bit LSB dynamic lib 80386 Version 1, dynamically linked, not stripped, no debugging information available
./t.o1
Segmentation fault (core dumped)

...so that needs more research. I also haven't tested on sparc.
It would probably be a lot smaller!
A step-by-step SEO Tutorial that will get you ranked every single…
Ok, I get it. The message is "don't use backdoors, because they'll inevitably get leaked", which I agree with.

Unfortunately, I don't think that's the message that's being interpreted by the vast majority of readers. I'm delving into opinion territory now, but when the word 'backdoor' is used, aren't most people going to assume that it's an FBI backdoor, instead of a test/development backdoor? This seems like the kind of article that fans the fuels of conspiracy theorists, and no one seems to be doing anything to correct the record.
Well now, that is interesting… deep packet inspection? or just a truly insane bug?

What router is it?
The secret scalar in ECDH doesn't need to be prime; it's just a random number.
It's not just about the code! You also have to establish a database connection.
Why not "United Kingdom"? Do Scotland, N. Ireland, and/or Wales compete separately at the Olympics?
We use a combination of both at my company. We use the standard environment for the majority of our services, doing things like proving APIs, serving webpages, performing datastore interactions, etc. The flexible environment starts to make a lot of sense when you're doing heavier weight processing, text analytics in our case. App Engine instances are relatively cheap when you're using the smallest instance sizes, and have even more benefits if your application has idle time when they can spin down completely, but costs start to go up very quickly if you need to move to the bigger instances in the standard environment [1]. The flexible environment is current billed at the rate of the machines you're using, so is much cheaper for bigger instances [2].

[1] https://cloud.google.com/appengine/pricing#standard_instance...

[2] https://cloud.google.com/compute/pricing#predefined_machine_...
That's really something i don't understand. After 5 hours of intense work i'm unable to code or think anything. I may be able to do many 4 hours work periods if i'm resting inbetween, but i can't do it multiple days in a row, otherwise i simply start slowing down and take bad decisions.

The best decisions i take are usually in the morning after a good night of sleep, and the problems i've been struggling for the evening simply seem a lot easier.

Even in week-end hackathons, the rookie's mistake is to not get enough sleep in the friday evening, create bugs during saturday, and end up completely unable to work on sunday.

Whenever i coach team, i usually tell them not to run the wrong race. If you're running a marathon, don't run at maximum pace because you'll never make it to the end.
I was just going off what the MDN page said about it being removed in the HTML5 standard. It looks like WHATWG just has a "living standard" and W3C still uses the versioning, so it's probably removed from W3C standards. I'm not too familiar with the reality of these standards.
It appears that PatientBank acts as a decentralized medical records/Release of Information office that may communicate with a number of physicians and hospitals. I'm curious though, how are you collecting the medical records? Are these interfaced directly from EHRs, or some other method? Do you handle releasing to 3rd parties (legal, etc); the article seems to hint that it's directly to patients and immediate family. Lastly, when a patient has shared their records with a new physician via PatientBank, is there any functionality for exporting these records into the physician's organization's EHR? Or will relevant data need to be manually copied into the new chart?
Teaching machines (quickly) about time and availability
John Carmack on Inlined Code (2007)
API could be in any form - be it a dll lib, wcf or rest so I am pasting a resource for each.

1. Restful API with WCF - https://msdn.microsoft.com/en-us/library/dd203052.aspx

2. Restful API using WebAPI - https://github.com/Microsoft/api-guidelines/blob/master/Guid...

3. API via dll - https://www.amazon.com/Framework-Design-Guidelines-Conventio...
Good question! We charge a flat fee for each medical record we gather. So whoever is requesting the record pays for it.

We can certainly work on making that clearer up front though—thanks for the feedback!
O3 World | Digital Product Design & Development Agency | Philadelphia, PA | Full Stack & Front End Developers | ONSITE

We’re developing products for financial services, SaaS and ecommerce clients.

Our projects include:

- Goal Investor ( https://www.goalinvestor.com/ ) Financial goal planning: Angular app backed Laravel APIs
- Cause Engine ( https://www.causeengine.com/ ) Marketplace connecting nonprofits with freelance professionals: Laravel App, relies on the Braintree Marketplace API

O3 Labs: Most of the time we’re heads down on client work, but we set aside time to experiment with emerging tech and have a little fun. Some of those projects include:

- Theme Music ( http://o3world.com/work/labs/o3-theme-music/ ): iOS and Android App that relies on iBeacons and a custom music playing server
- Project Mercury (aka O3 Poops) ( https://www.youtube.com/watch?v=NPDzwPaK2vI ): OS X Menubar app that relies on Raspberry Pis to let everyone know when the bathrooms are available:

Our stack includes: Laravel & Node, Angular & React, Sass

Our Interview Process: phone call, take home exercise, half day of onsite interviews

More details & to apply: http://o3world.com/careers/
This skirts a little too close to "2016 Doom doesn't run on my computer (A 12 year old Core Solo with first generation Intel graphics), don't give me a bunch of technical mumbo jumbo, I want to play it now!"

Also, if you want super easy game installs, use Steam. Either suck it up and accept the DRM or teach yourself enough Linux to understand how to deal with all of the myriad weird game installers.

It's not like the Windows versions are any better on the DRM front.
How do Olympic athletes pay the electric bill?
The difference is that the old manual system is not so prone to mass data breaches.

My employer used a service called NoMoreClipBoard. They enrolled everyone enrolled in a health plan, not just those who requested it.

When the inevitable data breach happened, everyone was affected not just those who had specifically enrolled for this service.

I don't ever want my medical records in any internet-facing system. I realize that's a fantasy but I'd never voluntarily help make that happen.

FTA: We use another YC company called Aptible. They’re experts in securing protected health information, and we follow best practices to make sure our servers are safe.

It's not just the security of the servers. Many data breaches are the result of careless handling of data (USB flash drives, laptops, email attachments) and social engineering attacks.
Glad you submitted this as I've needed an update of game AI field. A bit different than it was in my day but still shows what I argued all along: hybrid methods will be the best. Far game generation, I agree that generating many new, unpredictable experiences for the algorithm is ideal. I also agree it's within computational reach. Doesn't necessarily take AI, though.

For instance, much of that could be done with declarative, dynamic programming with templates, aspects, or constraint solvers. Idea being you create objects with relationships, attributes, and constraints. Let's look at an item object. It might have physical properties such as shape, size, movement speed, acceleration speed, ability to phase in/out, invisibility, and area of effect. It might have reactive properties where any of that changes in a specific way upon physical interaction, game event, or global setting. It might have effects on players that changing any existing attribute's value, remove one, or add one. It might cause a pre-registered event in game or for player with specific or random values input. Any of this can be programed using available languages as taking inputs, performing a computation on them, and producing output. Declarative aspect means that, after each is created with constraints or types, inference algorithms (even if-then's if you're masochist) can produce an imperative implementation that lines them all up properly for an actual game.

I'm not sure what the difficulty will be to do such things for an entire game rather than one item. However, one item on a map interacting with global & one, player's state trying to do all of the above might make a nice testbed. Then a number of items. Then a number of players. Whatever method works easily to solve it and generate efficient code gets used when approach is expanded to apply a similar range of attributes to player, map, NPC's, or even passage of time itself.

Just some thoughts on that. Haven't read your papers about specific algorithms yet. Did download Panorama for later reading. So, is anything close to what I described for generating a game engine from descriptions of parts in a way I described items? I think that, once enough stuff was loaded in, would generate a combinatorial explosion like wannabe AI's have never seen (and couldn't cheat easily).
Create JWT Token Header Using Unix Command Line Tools ONLY
Wow, this is a much friendlier alternative to what3words / what3fucks!

Few things that I felt could be potential issues:

1) GPS coordinates are great for approximations for areas without clear markers, but in built up urban areas, they don't work so well. As a stranger to a new city, I can fumble around and ask someone, "Excuse, can you help me find 222 Hyde Street?" And they'll hopefully point me in the right direction, and I'll wander wander over until I hit Hyde Street and try heading north and south depending on the numbers.

Secondly, if we hash the geocode, then we lose that sense of relativity. I no longer know if "Pearl" is east or west of "Tiger" and don't know which direction to move in.

In addition, there's still the final mile (or rather 3 meter) issue. When I'm at a particular lat/long, am I at the right spot? Or is my GPS off, or did the person put the pin just slightly off? Using traditionally addressing, when I have a house number, I know it's the right house because it says so on the door.

2) The icons used for error-checking may not be universally known. For example, 83.png is a hat, but for someone unfamiliar with this, it's.. a horn? a bell? I know this was an MVP to show (and it's great!), but it is something to keep in mind.

Ultimately, I think this has potential for the delivery industry (before drivers get replaced by drones/driveless cars, of course). It's already more intuitive than the chiban-style addressing system in Japan [0]. However, similar to that system, we're still reliant on book/web site/app to decode the address. And so here, we're assuming people will readily have access to a smartphone with a reliable GPS.

[0] https://en.wikipedia.org/wiki/Japanese_addressing_system
Software engineers as leaders
Developer Relations team exists so that doesn't happen so sorry to hear. Part of the problem is some of our feedback mechanisms need work. If you go to:

cloud.google.com/python

You'll see we have a lot of tutorials that link to Github repos . If you file issues there you are more likely to get help. The caveat is we are not a support team and have no guarantees (just a likelihood), so if you need paid support look into our options for that instead.
The original linked hack is clever. But this page is just confusing (in Safari on OS X), for several reasons, not the least of which is the fact that the page is in fact served over https, and if I mouse over the padlock and click it, everything behaves correctly (and even if the page was specially designed for Safari and could figure out where the url bar was, it can't even replicate the behavior Safari has for clicking the padlock because web pages can't show sheet dialogs).

Part of the problem here is the fact that the fake cursor never actually escapes the page on this one. When my mouse is near the top of the page it reverts back to the system cursor instead of the fake one, before it even leaves the frame of the page. The original linked hack worked much better.
Actually, I bet Kraftwerk could make it happen.
It seems pretty unlikely that we're ever going to uncover a practical vulnerability owing to the observations of this paper.
There's a difference between being honest and always saying what you think. You should be honest in your interactions but that doesn't mean you should tell everyone everything. You can be honest while being tactful.

I think there's a line between being tactful and being manipulative and it may be different for everyone. For example you seem to think that Steve is telling a "white lie by omission" but I don't. Unless Steve was dishonest if questioned about his motivation or Steve was trying to pretend to be into the game rather being interested in Jack and his interests I wouldn't consider that being dishonest.
We make it really easy to request medical records, but we also verify requesters' identity before allowing them to view medical records we collect. We actually use an awesome YC company called BlockScore to handle a lot of that (https://blockscore.com/)!
Just put it in a JPEG and send it over.
Same here with file(1) version 5.22 from the Debian jessie package repo. I'd be interested to know in which versions this kind of thing actually works.
My guess is Assange thinks that Hillary Clinton wants to torture him. For him it is victory or death, he has nothing to lose.
Moreover, by phrasing it like that ("I'm getting frustrated"), you are imposing your demands on your friend without even informing about their state of mind. Not acknowledging them is not the way to keep friends close.
More Than 1M US Corporate Salaries Exposed
> offering 0.025% of common stock to your early engineering hires has become common practice.

Well, you have to add extra information to that 0.025% figure to determine if that seemingly "low percentage" of equity became decent money.

As an example, it looks like Chris Cox, an early 2005 hire of Facebook[1] and now Chief Product Officer got ~0.025% of Facebook stock. (~600k of 2.5 billion shares.) He started unloading some of them in 2014 (2 years after the IPO).[2]

That 0.025% in 2016 now worth ~$77 million.

Of course, not every startup will become a Facebook with a market cap of $350 billion. So instead, let's say we can work backwards from a "nice" target number such as $5 million. For 0.025% stake to be worth $5 million, the company has to grow to a $20 billion valuation. That's still a big number but building a company worth multiple billions is an aspiration for many startups. The pontential employees have to consider if the "lottery tickets" with a payout of $0 to millions is worth the lower salaries.

If a startup sets aside 10% stock for employees' pool, have other companies proven that you'll get better results by granting more than 0.025%? Should they have given Chris Cox 1% so other subsequent employees get less % or none at all? Lots of potential game theory questions to ponder.

[1]https://en.wikipedia.org/wiki/Chris_Cox_(Facebook)

[2]https://www.insidermole.com/insider/cox-christopher-k/transa...
The livecoding with ScalaJS was especially impressive:
http://www.lihaoyi.com/post/TalksIveGiven.html#live-coding-s...
I like my rights.

I can't spend a full day in jail each time I want to protest against a right abuse. I have to pick and choose my battles.

Tragedy of the commons says that even if you are right - if we ALL stood up against this it would stop.. for me specifically, it is more convenient to not. So most other people will not. And in fact I am not a photographer, so standing up for photography rights is pretty far down on my priority list.
Pair debugging is an exercise in patience that I often lose.

If I had a dollar for every time I asked someone "Okay, look for other uses of this variable" and they grab the mouse and stare at the screen because THEY'RE READING THE ENTIRE FILE LOOKING FOR A PIECE OF TEXT, instead of using any of the dozens of search mechanisms at their disposal, I could retire and write self-help books for programmers.

Stop trying to white-knuckle everything all the time, you masochistic people. Use tools like a sentient creature is supposed to.
there's also elm and purescript, both of which are haskell likes
> "Britain". You mean "Great Britain".

Well, its not like this is a case where anyone is going to make the mistake of thinking the intended reference was to Lesser Britain rather than Great Britain.
That's fair. Personally, I'm excited to have another way to manage side effects on a platform that has so many of them.
Google's Open Location Code is better. https://github.com/google/open-location-code
requiring admin rights for an exploit is certainly a lower barrier to entry than is requiring physical access, but I think my point still stands: if someone has those rights, you're already screwed.
Why? I mean as if the parent was on topic... and this is a little joke, jokes don't kill.
If you like pcg maps, have a giggle at my pirate-themed maps and the awful js code behind it.

https://github.com/wlievens/scallywag
Thanks for the explanation.

So it sounds like the critical thing that Windows resources have over the thing I outlined is that they and their namespaces are relatively transparent to external tools such as the Program Manager.

The critical thing is that MS could impose a standard. Anyone can write tools to put such a section to their ELF binaries. But it would be useless because then no one would know to read it.
JPEG images allow comments. The html is stored in the comment. Browsers assume they are reading an HTML file and loads the comment. When the browser thinks it is reading an image, like in an <img> tag, it reads the image ignoring the comment.
You've really hit the nail on the head with respect to Linux package systems. They're really designed for open source software and have a major blind spot when dealing with projects that are only distributed as binaries and not actively maintained.

I would go so far as to say that they're simply not suitable for binary only distribution unless the owner is willing to maintain the project. Some alternate solution should be used instead--maybe a Docker like solution? Or just Windows/Mac style "pack up all of the dependances, including glibc, and accept that every install is going to be big and bloated".
Are there any plans for a headless server. I'm still looking for a good way to sync my NAS to my desktop.
In addition to identity verification, there are two more things we do to protect the privacy of our patients!

1) If the electronic signature on a given request doesn't match the name of the patient, we make sure that the patients are who they say they are before moving on with gathering the medical records.

2) If one tries to sign up on behalf of another patient, we require a Power of Attorney (POA) document!

Hope this answers your question!
What legal protections are you offering to ensure my patient data is not monetized down the road, directly or in aggregate? How would you protect patient data in the event you sell or go under?
Digging into the CoreCLR: JIT Introduction
The Next Generation of Open Source Blockchains
Rice's theorem is a statement about partial functions, not programs. There exist decidable properties of programs: Is it of size less than N (for any suitable measure)? Does it finish in less than N steps (for a given fixed input)? Two syntactically distinct programs may compute the same partial function.
Yes, from what I've read, the researchers discovered that the PGP keys were made by the PGP software and so on.
New Publisher Tools for 360 Video
OK great - thanks. Just to be clear, you'd still be opening up DB ports to all internal global GCE instances?
I love how y'all seem to be using lots of other YC companies to get the job done. Seems like a great service you provide!
I wonder if browsers are smart enough to only download the file once for the html and then cache it for the embedded image.