skysight-inc/HackerNews huggingface dataset:
> Many of the other items on the list are unfair to CMS's with a large and thriving plugin ecosystem.

It is explicitly an out-of-the-box comparison.

> Security is a worthy goal, but when it comes to CMS's, a healthy FOSS ecosystem is just as important to support and nurture. You can't try to do everything in the core.

We agree. Airship is free software and has powerful support for plugins. We just try to solve 99% of the security problems in the core so plugin developers can just use the features we provide and don't have to worry about low-level concerns.
Ask HN: How do you come up with progressive project ideas?
I program inside and outside of work. As some of you, I absolutely love learning, creating, and problem solving. I am how ever at a point with my job where I no longer feeling as though I am growing. I feel static and I need more challenge.

My problem is that I am having a hard time come up with a meaningful project to take on. Are there any methods, or strategies to find an area no one has touched? I always see blog posts, or github repositories of awesome projects other developers create / contribute to.

How do I find something like that? Something that is relevant & beneficial to my growth as a programmer?
From the Transistor to the Web Browser
Agreed, there are reasons why we do certain things a certain way. But in the age of ransomware and endless cyberwars and nation state spoofing maybe the idea that browsers and other internet facing applications should be barely-shippable shit code is antiquated.
Compromising Linux virtual machines via FFS Rowhammer attack
Oh you young people. Next Decade? Try 24 years ago. A little game called Wolfenstein 3D used raycasting.

(Yes I know the subtleties that distinguish ray[tracing|marching|casting].)
sure, but you are in total control with how often you check your email.
This isn't a secret button, just a result of using Aero on Windows 7, which hides the button. It was actually something that irked me from time to time, because I'd grab a window to move it, only to hit the button and activate the menu.
I was in Kansas City the other day. Seems like a place where a software developer could actually afford to live in a hip urban neighborhood a short Uber ride away from work, even with a family. Good luck doing that in San Francisco.

(Also, having kids doesn't mean you can't be hip and urban. Urban centers are full of kids! We went trick-or-treating in Capitol Hill last year, and it was hard to fit in the sidewalk with all the parents and kids.)
IIRC it changed one or two months ago, they reduced the downvote window from ¿24? hours to ¿8? hours. I guess it's permanent until they change it, or you can call it an experiment :). Don't get fooled by the constant plain look of the site, the mods change the little details constantly to try to improve the conversation and behavior.

If you want more information, you can try contacting the mods hn@ycombinator.com . They usually answer in a few hours, but I'm not sure if they want to provide too much details because they may tweak this in the future without warning.
Roger, it's not the opiates, it's the trick:

"An international team of researchers — . . . Their secret? Starting from scratch — with computational techniques that let them explore more than four trillion different chemical interactions."

This was exactly my idea back in the mid-'70's when I thought of one of the ways computer science could be applied to drug development. Of course all we had were mainframes, but so did the drug companies.

Then, my first employment was with a pharmaceutical producer, I got the impression they were actually further away from this compared to starting a whole new drug company from scratch itself.

Until new antibiotics come along, when necessary you might want to investigate older, more well-established germ-killers like colloidal silver. The real thing is hard to beat, but it is outnumbered by quack versions and get-rich-quick schemers.
Just to counterbalance all the posts trying to make equivalences or complain about ad-blockers, some of them even portraying it as "poor little guy":

I am fully in support of any and all ad-blocking initiatives. Thank you very much to everyone working against Facebook on this!
Having read the inspiration article, I chuckled at the seemingly satiristic tone.

Then I read this one and cried. There's a lot of truth here (I live in WI).

>You try out cost of living calculations and they say you'd need to make 250% your current salary on the west coast. Annoyed at the seemingly impossible move, you tell yourself they'll be rioting over water shortages soon anyways. After all, do you even want to be near the coast when the oceans rise?

And this. This is so true.
>Other countries, particularly China and Russia, had put pressure on the UN to call for the DNS to be controlled by the United Nations’ International Telecommunication Union.

I'm no diplomat, but I suspect any move that's primarily advocated by Russia and China can't be good for [internet] freedom.
Is it just me, or are the links at [0] broken? That is, when you try to click through some of the examples such as "Use F# to explore the .NET framework interactively"?

[0]: https://swlaschin.gitbooks.io/fsharpforfunandprofit/content/...
Mozilla shuts down Persona
I miss those days of running a local point for my own mail. I enjoyed connecting with the local and remote communities - it was basically a form of one-to-one and group letter writing.

Although at one point a misconfigured node was calling my home number multiple times during the middle of the night. That part wasn't fun!.
Yeah, totally. The barrage of constant notifications is the real problem. I used to keep my email open all the time. Over the last year i've disabled all email notification and check every hour or so.
Leaked Equation Group Exploit Codenames
Similar to an idea I've had for a slow messenger.

It talks about threads and "number of tasks you're working on". Is this thing targeted for use at work? because that seems like the worst use case for the limitations it outlines.

I imagine it more as a digital snail mail with a digital mailman bringing you messages once a day. An effort to bring the romanticism of a messenger bringing you an important message.
80-year-old woman arrested with dead baby in Lagos – Punch Newspapers
You do use a mac though...
My point still stands. I don't think it's very likely that the main power hog in a mobile phone is the IPC mechanism. Unless IPC is happening in a tight loop, on the order of millions if times per second, it's just not common enough to really make a dent.

You have wifi, screen brightness, CPU-hungry background apps, etc. to fix first.
You would think so, as even snow messes most selfdriving setups right now. Because of legislation, Finland is actually aiming to be the foreground of testing for these kind of environments. "Lapland Proving Grounds" is building a own highway in Lapland, just for test purposes.
This looks like a poorly written sponsored article.

More housing will boom real estate market, and only for short term. I don't believe new housing will help average Joe to have better prices. To the contrary, it will make some real estate investors richer.
Did something similar a few years ago... a port of the classic demo effect to JS/Canvas :) https://jstsch.com/post/old-skool_fire_demo_effect_in_javasc...
Not for subwindows, like dialog boxes that take focus on a program.
I wish Facebook would offer an option to pay to remove ads / reduce tracking. I understand that they have to operate a business, and if I don't want to pay they should be able to show me ads. If I do want to pay it would be nice to be able to remove the tracking/ads. It looks like facebook only pulls in about $10 per user[1], I'd happily pay a few dollars a month for an ad free service

1. http://www.businessinsider.com/facebook-average-revenue-per-...
Emacs for writers
Interesting article, different point of view for sure, but I have a bit of trouble with sentences such as:

"More housing would mean lower rent and a bigger economy" : I'm all for increasing density (up to European equivalents), but more density adds complexity and more costs (waste disposal, parking space, public transport, local commerce, health issues). I'm not an urban planner, but most of the high-density areas I've seen in my city, even those outside the core, are pretty expensive places (i.e. buildings with 10+ floors).

The author also mentions the need for serious urban planning, while seeing a need for "liberalizing housing regulations". That's a bit contradictory.

Also, we need a culture shift in terms of how we see high density. The urban core is not just for 20-somethings looking for an opportunity. An old industrial area was converted to high-rise buildings in the past 10 years in my city, and they didn't plan a single school. Now young professionals moved in, they like the area, have kids, but want to stay in that area. (it's no different than living in Manhattan with kids, which is not a problem if you can afford it)
Not exactly the same, but here's a 50% off coupon code for the whole thing, so only $20 for the whole book.

"mltrask"
Not really, but have seen plenty of real-life examples.

Main point is you can NOT gain muscular mass at that age unless you take supplements or start eating protein foods like crazy! Both will mess up with your metabolism, do you agree? I m not saying going to the gym for exercising is bad per se, just early mass gain.
Here's a 50% off coupon code, so only $20 for the whole thing

"mltrask"
> I don't quite see the issue here.

Well there really is only one country in the world that has 'Freedom of Speech' codified into law.

In reality, any country can abuse it's position, but in regards the internet it doesn't really appear that it has ever happened. This is very much change for change sake without any real benefit to be seen.
It worked for me. I'm a true digital nomad. I moved out of the US and work whatever hours I want totally remotely. I firmly believe this is the future. Maybe it's taking longer than anticipated but it _is_ happening more and more. Just search "digital nomad" for a taste.
(that expires Aug 26 btw)
* I have a smartphone that does not send info to google or apple.

Runs Andriod with no google account, no Google Services, and my app store is FDriod not the play store. *

Same here. It's really not as difficult or inconvenient as people assume.
That's Microsoft's argument in a nutshell, yep. I strongly disagree with it.

I play videogames, so I'm forced to use Win10. But if I wasn't, I would have switched to OSX over this.
While I might not "get it," I never got why you would limit a message to 160 characters either, and those guys seem to be doing ok.
Come help improve these "buses" at Junction [1] hackathon :)

[1]http://hackjunction.com/
(expires August 26th)
I'm in control of what I put in my mouth too. Still don't buy the family size chocolate.
I added a footnote to clarify the intent.

The point of short statements like that is to encourage further scrutiny from skeptical security folks. Our previous attempts just led to people nodding along and saying "Sounds great!"

https://paragonie.com/blog/2016/05/keyggdrasil-continuum-cry...
50% off coupon code!! (expires Aug 26)

"mltrask"
Driving without anyone in the car is still completely driverless. That human-free car will still need to navigate through the environment with hitting anyone or anything with zero possibility of intervention.
They're also open about what they allow. Follow this link to find the filters etc: https://adblockplus.org/acceptable-ads#list
Came here to say just that. AdBlock relies heavily on SEO to grow it's install base. If you search "ad blocking" they rank highest, because of their name alone. This story will probably win them a huge boost and am hoping uBlock or similar take the lead on this one.

At a publisher conference, I recently saw PageFair take stage and sell their solution as an anti-ad-blocking ad-serving network. Turns out they pay AdBlock to get unblocked and their entire budget seems to be spent on SEO and trade fairs. I found this on their FAQ very amusing:

> Q: I tested my installation by activating the uBlock Chrome extension and the PageFair script did not load

> A: The adblock community maintains a number of different "block lists" of domains and resources that should be blocked from loading. One particular list (Easylist) is used by the most popular extensions AdblockPlus and Adblock. This list does not block PageFair's analytics from loading. There is an additional list called EasyPrivacy which is not used by default in AdblockPlus or Adblock, but is used by default in uBlock. Our analytics (as well as most other analytics tools like Google Analytics) are blocked by the EasyPrivacy list.

> You should be able to try out a different extension to verify this.

https://support.pagefair.com/support/solutions/articles/5000...
We are Eve – A small tech company competing with the tech goliaths
Assuming engineering was size X, sales would be 10X and legal 40X. Oracle licensing and legal are unbelievable snakes.
Right, but there is a race where you only swim in one direction
4 Clever Ways to Reach More Customers on Facebook
So you think the demand for housing in San Francisco is literally infinite?
As much as I dislike excessive surveillance, it's worth pointing out that defenders of free speech far outweigh proponents of gathering data for eavesdropping. Of course, the USA enjoyed free speech before the internet existed. It's one of our strongest values. I partly grew up abroad and have friends in numerous countries where people do not have the right to speak their mind, and this should not be taken lightly. Again, I am not a fan of the extensive surveillance, but the "good track record" does not have its foundation in eavesdropping.
Do You Know Who Your Customers Really Are?
Why App Developers Should Care About App Security
I agree, FidoNet was a wonderful technology. My local BBS also had access to several newsgroups that were synced nightly. Between the two, I had plenty of material to keep my young mind busy. Perhaps too much material (some of the alt. newsgroups were probably not best for a ~9 year old :))
Nice work. Effects like these are a great example of programmers combining theory, art, and creative optimizations.
Ask HN: Validating a social media tutorial series idea via ads and launch page?
Hi HN, lately I've been thinking about creating a tutorial series on something I am knowledgeable about, from hands-on experience and also many logged hours within the community.

The topic I would like to cover is about creating an online presence, from initial setup to content creation, for Vlogging (YouTube and other) and its live-counterpart (Twitch gaming, Twitch social/talk show, etc.). I've been reading about startups and projects for a while (on HN, Product Hunt, and other sites), and learned that execution is more important than the 'idea', but validation of the idea is critical in the early phases.

My plan was to create the shell of a blog and then begin writing a few posts - one would include some kind of 'road map' of content, and a few starting posts related to the topic. For idea validation, I was going to advertise the blog in a few locations, setup an email list to capture viewers/interested people, and possibly throw down a $5-10 targeted Facebook ad campaign and Google ad campaign.

Is this the right approach? I have been thinking about this for a little while but I get cold feet when thinking about starting. I would like to create not only text blog posts, but also screenshot walkthroughs, possibly bite-sized video tutorials, etc. Thanks for taking a few minutes to provide feedback.
Using Create-React-app with React Router, Express.js and Docker
I will give them the benefit of the doubt and assume its the later and not the former. If someone took a Valgrind substitute for Windows and ran a few game bundles, I would guess that over 90% of them has some kind of detectable bug in them in regard to memory management. Access to uninitiated memory and access to free'ed memory should be detected even if you have no access to the source code.

Out of the 10000 bugs that was mentioned by the article, I wonder how many got rated critical by up stream.
Because it appears that the type of ads that fall under "whatever they like" include malware and processor-intensive ads. Once I could tell that something was wrong because my fan turned on while just browsing the internet. Turned out I had a tab in incognito open and adblock was not enabled for incognito, so the ads on the page were so processor intensive they caused load on my system. That's not an okay thing to do.

So, I'll continue to use adblock AND use the services until they dial back their obtrusive ads.
Look for pain. Listen to people complaining. Measure things and look for repetition. Those things are sources of easily identified problems (but not necessarily easy solutions).
This allows future improvements like adding Redux and server-side rendering. But this is a good starting point.
CSS margins/paddings for non-designers
Persona Shutdown
Never again worry about zero-days.

That's pure snake oil. The little asterisk compounds their mistake:

Because updates are securely installed within one
hour of their availability, the time-scale of a
fix being applied is no longer meaningfully
measured in days. Zero hours are the new zero
days.

That's not what "zero day" means. It isn't the time between a security fix becoming available and a vulnerable system installing said patch. Rather, it's the time between a vulnerability being discovered and said vulnerability being disclosed. It's great that this vendor has mechanism for quickly distributing security updates, but that isn't going to mitigate zero day vulnerabilities. Rather, zero days would be mitigated by SDLC activities that would help them discover novel vulnerabilities in their code, like design/code reviews, static analysis, or fuzzing. If they want to reassure their customers that they're good at infosec, then they need to do a lot more than spout some BS about how their automatic update mechanism stops zero days when it can't.
You trust a closed source OS from a developer already proven to be willing to engineer backdoors and lie about it over an open-source OS? Can you explain your reasoning?

I don't actually _trust_ either one, but I would certainly rank Windows below Linux.

Also note that the linux runtime in Win10 is not installed or activated by default; you need to put the OS in developer mode and install it yourself. If an attacker can do that externally, he already owns your system.
Don't sell either effort short, do both.
If I smear insults on your shopfront window with a whiteboard marker, is that not vandalism? It leaves no trace and takes only a minute to remove, no special equipment required.
Alien Languages: How We Talk About Procedural Generation
I imagine navigating 376 coming into Downtown out the of Fort Pitt tunnel to be insane. I can barely do it as a human. Everyone is entering and trying to cross the 4 lanes to exit on the opposite side with in about 100 yards of roadway.
Yes, it is a hack. I maintain the publicsuffix Python library (https://pypi.python.org/pypi/publicsuffix/).

I had many long discussions with package and application maintainers on the topic of how to best provide data to the library. Arguably you need an up-to-date version of the list if you want to access the web securely today.

You can bundle a static version with the library. That's nice for developers, and users because it just works after "pip install", but will get out of date because library won't update as often as the list changes. Some distros like Debian provide their own mechanism for updating the list.

You can also download behind the scenes and cache. This way data is always up to date, but users don't like that apps call some web service on start-up and some people want to use the library off-line.

If you look at different libraries and apps, each one does it differently. Getting it right is hard. Things would be so much easier if this information would come decentralized from the DNS system.
Yet another react boilerplate from dummy for dummies
Eleven Reasons to Be Excited About the Future of Technology
http://latimesblogs.latimes.com/lanow/2012/07/chalk-protest-...
Update your login information for MDN
Dear MDN contributor,

You are getting this message because you use Persona to log in to your account on MDN.

We are discontinuing Persona as a sign-in method. If you want to keep access to your account, you must link your profile to a GitHub account.

If you do not have a GitHub account, you will need to create one.

If you do not link your profile to a GitHub account by Oct. 31, you will not be able to log in to MDN using your current profile, create or update pages, or update your profile. We recognize that this is an inconvenience, and we apologize.

If you have questions, please let us know. You can also read more on MDN about this change.

Thank you,
The MDN Team
Does Tuition-Free College Really Solve the Student Debt Crisis?
http://ncjolt.org/googles-distrust-of-chinese-digital-certif...

CNNIC was the root of trust for a breach involving false certificates for gmail. They claim it was an accident. It might have been. It might not have been.
> Closed source software uses code analyzers/linters too.

Some might be surprised just how many don't even do that. Several of the products I've worked on relied solely on bug reports (internal and external). If it compiled and passed QA, it went into the field.
Whilst Kenya was an undoubted low point of the British overseas territories, it's chilling to think they were markedly better behaved than the French and especially Belgian colonies in Africa.

Quite how any of these were able to rationalise such behaviour, and so comparatively recently, whilst claiming to be civilised beats me.
Based on your logic, why would anyone ever open up a new restaurant?
I see it coming: "Pay five bucks to get your message delivered in just ten minutes!"
Note that in the past the USG abused its power to seize domains belonging to foreign companies. See for example https://www.techdirt.com/articles/20110201/10252412910/homel...

So they cannot be trusted.

Of course, in practice, what goes into the root zone is controlled by ICANN. The whole oversight has been mostly theoretical for many years now.
Good point, don't know why I didn't think of Zipcar when I used a similar service last year.

Looks like the bigger problem might be people suing over accidents where they were distracted and forced to make a split second decision, when they 'reasonably' expected the car to be able to handle the conditions. (Not trying to shift the goal posts, just sharing a separate concern).
Ask HN: Do you use a linter in Java?
Do people use linters for Java? They seem essential for a language like C/C++ while superflouos for a language like Go with it's strict compiler, but Java seems to float somewhere in between.
He might be genuinely trying to find out what your situation is. Your defensiveness is kind of a red flag.
> That's not what "zero day" means.

It's half of the practical concerns with zero days, and the half that most software teams have the least amount of control over.

> It's great that this vendor has mechanism for quickly distributing security updates, but that isn't going to mitigate zero day vulnerabilities.

See: http://www.tripwire.com/state-of-security/incident-detection...

> Rather, zero days would be mitigated by SDLC activities that would help them discover novel vulnerabilities in their code, like design/code reviews, static analysis, or fuzzing.

That's correct, but nontechnical users aren't interested in these details. What's more interesting to them is "When it's fixed, I won't have to do anything to not be vulnerable."

> If they want to reassure their customers that they're good at infosec, then they need to do a lot more than spout some BS about how their automatic update mechanism stops zero days when it can't.

I'll refine the wording a bit better. Thanks for the feedback.