skysight-inc/HackerNews huggingface dataset:
> I'm not sure there's a good way of limiting how much companies are allowed to charge for a service.

That of course depends on one's subjective notion of "good". There are multiple ways of doing it. I like the one you suggest if the amount we are talking about is a round zero.

> I'm also not sure what you're suggesting with "exercise their copyrights on prestigious journal title".

If the members of a journal's scientific board decide they want to go full real open access (with no costs for readers nor authors), they have to abandon to name of the journal and the associated impact factor and reputation that they build together with their work over the years, because the publisher owns the journal even though it is the board members who did all the work (as part of their job as researchers, paid by the state or a uni for example, not by the publisher).

That's one of the reseaons why the movement for open access and the movement against the use of bibliometrics should unite.

Thanks for the disclaimer.
> In order to give it away to whoever picks it up first, you need to create clear intent - a posting in plain English, for example.

So we have someone who takes that proverbial duffel bag full of money, lays it down on the information superhighway, and puts a sign on it which says, 'SPEND_WITH_PASSWORD'. So Malory picks up the bag, opens it up with the password, and spends the money. They didn't "intend" for that to happen, but they signed a contract which says exactly that. The best example I've heard where this is not a valid defense is the life insurance policy written by Aviva France which allowed retroactive trading (a.k.a printing money) and where the policy could now be worth billions of dollars. [1]

Can code ever be a contract? I think so. What if the code functions exactly as designed, and exactly as advertised, is it then a contract? A world where you don't have the freedom to follow clear and obvious labels does not function very well. If someone puts a water fountain on a public way, and then sues people for drinking from it claiming they stole the water, I would hope those claims would be thrown out and the claimant censured.

The right answer is, of course, no one should be laying their money down with a sign on it that says 'SPEND_WITH_PASSWORD' if that's not what they want to have happen -- because trying to recover that money after the fact when someone picks it up is going to be challenging, to say the least. But I do think it's an interesting argument to say that the person who did pick it up with the right password actually did nothing legally wrong, and even ethically or morally wrong.

Even more-so, I find arguments that 'SPEND_WITH_PASSWORD' should actually mean 'SPEND_WITH_PASSWORD_AND_CONSENT' to be highly problematic for a decentralized blockchain which can trade smart assets. A crypto-currency should be expected to do what it says on the label, and users should be expected to read the label before using it. See, for example, the many cases of inadvertently large transaction fees, and even that's a more clear cut example of programming error, or human error, than 'SPENT_WITH_PASSWORD' which does exactly what it says.

[1] - http://ftalphaville.ft.com/2015/02/27/2120422/meet-the-man-w...
I've been working in the permissioned blockchain space for a couple years now, even OSed a POC of a raft based system we tested out at JPM in march. It is truly scary how little most people focused on blockchain understand about consensus. Some get it, but most don't.

When I was doing vendor vetting the talk usually revolved around the "blockchain revolution" but glossed over over the consensus issues. In the permissioned blockchain space, mining is really not an option (how do the incentives for mining work when there are no coins involved?). Luckily, we have a lot more flexibility in the consensus system we can pick.

Moreover, the term "blockchain" itself is ill-defined/overloaded. If all blockchains use mining then the 51% issue is ever present (though if I remember correctly problems arise at 30-ish%). If the broader "BFT consensus" definition is used then no, you can use PBFT/SmartBFT and a host of others to come to consensus without ever needing to touch crypto let alone mining. The issue, of course, is that Mining-based consensus is the only system that works for truly public blockchains, as it allows for anonymous participation at all levels and can also scale flat.

If anyone else is a consensus nerd, I wrote a technical-biz-persone level white paper on permissioned blockchains that goes into more depth and covers the issues associated with using TLS vs PPK sigs [1].

[0]: http://github.com/kadena-io/juno

[1]: http://kadena.io/docs/Kadena-ConsensusWhitePaper-Aug2016.pdf
Hi Tom, very biased here, but I interned at MWR InfoSecurity and the team there seemed to be consistently very high quality (like finding 0-days in Chrome, Windows Kernel, etc) - would definitely recommend looking at them.
TL;DR: Just to announce that the price is now available. From 141 to 199 euros, including VAT
The attack is too complicated for fraudsters, because it's multi-stage. They have to perpetrate a heist to get the certificate, and then another heist to MITM people to use the certificate (you can potentially use the DNS for both attacks, but they're still different attacks). DNS spoofing is not common in the real world, because it has low payoff.
In the UK my national insurance contributions are about %8 but that does just go into the general tax pool and is not hypothecated to be spend on the NHS/health.
Anyone know how much Intel paid?
In my perfect world, you'd receive a certificate from your ISP when it assigns you one of the IP addresses it was itself assigned, and you'd receive a certificate from your registrar when you purchase a domain name. The former certificate would be good for the duration of your IP assignment; the latter for the duration of your domain ownership.

The IP-level certificate would be used for IPsec; the DNS-level certificate would be used for HTTP and other protocols; if you needed some other, stronger sort of identity verification then you'd need to take other measures.

This would solve the accessibility problem.

As for proxying, I think that HTTP had a really interesting idea with proxying, but it just doesn't work in practice. Proxies are untrustworthy, so it doesn't make sense to use them.

As for speed, I don't think SSL is noticeably slow from a modern phone.
This is precisely why, despite being a software security consultant, I don't cold email folks. Even if they don't perceive it as a threat, it feels too much like one to even write such an email.
Based on the experience of myself and acquaintances your experience seems to be an outliers. Obviously it's just anecdote vs anecdote.
so, we supposed to care?
That and seek damage from the people who orchestrated the defrauding. This was a "for profit" institution, follow the profit to the CEO and others.
> you go to facebook....

As I mentioned in my first comment, you create network with whom you wish to create network with. So it doesn't matter where your friends are (be that Facebook, or at home, just a phone call away); it is you who is going to reach out to them, to create a social network.

> provide appropriate tools for your friends to create your network

Each individual creates his or her own network. So if someone reaches you first, seeking your company to get you into their network, it is as same as you reaching them, asking them to join yours.

My ultimate point is, that the "platform" does not create a social network (for humans). The best they can do, is create bells, whistles and tools. Humans create their own social network.
Capitalism is not just people trading with each other. We invented lots of legal fictions to get where we are today, and they're pretty effective. For instance, if you contribute your capital to a corporation, you'll be rewarded with an agreed upon portion of the corporations dividends. It looks like the company is rewarding you, but it's really society. We create and enforce rules like these—private property, limited liability, etc.—because they make us more prosperous. But they're artificial. They're not laws of nature. They can have flaws.
With the disclaimer that this is an anecdote and not data:

You would be surprised at how easily a winners win situation happens in research. The citation based search would reinforce it. And while the gaming may not be search engine focused, I think getting the best papers via algorithmic methods can omit the crown jewels through less insidious (but quite common) issues such as citation graphs which orient in the direction of the flow of funding.

But you say, maybe winners win for a reason. This is only personal experience, but the single most profound, creative paper I ever read during my years of research was written by a lone wolf (i.e. no collaborators) in a somewhat unknown institution who turned out to be a sort of one hit wonder. This person's h-index may very well have been exactly 1 at that time. I honestly think algorithmic methods of searching for literature would have skipped past that paper.

You could make the case, though, that a thorough literature survey should be as exhaustive as possible and not omit ANYTHING. Well, very few people are that thorough - and even when they are, there is a tendency of reading papers from the most popular authors first. I am just glad I did my work before the days of Google Scholar becoming the de facto starting point, and I did not have the bias of a pre-ranked list.

I think that is the actual fear: I was able to find this crown jewel precisely because the publishing process at that period was more centralized (although quite likely also less competitive), and that paper was eventually published at a pre-eminent conference - which is how it came to my attention. With a search-engine driven open access, I think this lone wolf would have had a harder time getting that fantastic piece of work in front of a big audience because many of the common signals would have been too weak.

With all that said, when open access becomes more pervasive, great search technology will be a big part of the cost reduction and I definitely look forward to that.
> Are you being sarcastic?

Yes. I thought the sarcasm was self-apparent as the "all American TV manufacturers are shuttered" trope is well-worn and well-known (apparently not). A quick test would have been trying to think of one cool American TV model.
I can appreciate the general sentiment, but at least for this post specifically I'm not sure I agree.

The subtle aspects of these two charts are really interesting. Like, the only non-rich group to see income gains in the US is the ~15th percentile group? That's striking, and deserves some consideration. (At a guess, EITC and Clinton's work-for-benefits programs have helped the employed-near-minimum-wage cohort, but not the very poor.) The 2000-2014 numbers are similarly interesting - we see that the ~90th percentile (e.g. surgeons) was insulated from the crash better than the middle class or the very rich, but that the very rich have rebounded completely.

So yes, signaling is different from actual action, but I'm filing this one under 'education'. For me at least, I'm interested more by the subtleties than by the basic restatement of "this is an issue".
Apple's engineering is good too, it enables them to actually deliver on those designs.
> Just move to autralia/europe.

Being in Europe doesn't seem to have helped the editors of Charlie Hebdo …
'The "capitalist system", much like evolution, does not have goals'

That's true. Markets are just feedback mechanisms. Like a thermostat. It's politics and public discourse what decide what the temperature in the room should be.

You say that we should try to know what have changed within capitalism but I think that the answer is that nothing have changed.

The times we are living have a lot of similarity to the 20's and 30's and they are the opposite of the age from the end of the Second World War to the 70's when the pendulum swung to the other side.

It's just the old history of capital vs. labour, everyone of them in one side of the rope, the rope being the government.

I suppose that automation of mental work is what could make this time different.
Google PolyLine explained (C# example)
One frustrating thing I have found about companies willing to hire remotely is that many refuse to be your first remote gig; i.e. they only hire people who already have years of experience working remote. I understand the hesitation, but if good people really are so hard to find it should be a hesitation that can't stand up in the face of being unable to get things done.

Then again, neither should resistance to remote developers in general or the myriad of other, more bullshit things that go on in sourcing talent. Makes me wonder how self-imposed the "talent shortage" is.
Washington Post Unveils ‘Lightning-Fast’ Mobile Website
System.Drawing actually wraps GDI win32 calls, so while it works, running it on a server would be iffy, and running it on non Windows would be impossible.

Now, they could reimplement system.drawing using a different backend per platform, but I don't think the demand is high enough.
Uhh, hand-off between cell sites is clearly disruptive discontinuity. You can link this to the invention of radio well after telegraphs / telephones. But, radio is very much it's own thing.

What makes it seem like a smooth transition is the length of time it takes to get to consumer products plus the need to seem like prior products. Internal combustion engines where around for a log time before being refined enough for portable power. But, heat engines are very much their own thing. Similarly battery's and capacitors are their own things. However, when you get a car it's got a huge range of such disruptions packaged into one thing.
If you're trying to import Postman collections into Paw, that's easy https://paw.cloud/docs/migrate/postman (all requests, grouping, environment variables, etc. will be preserved). Once imported, you can even generate a Swagger https://paw.cloud/extensions/SwaggerGenerator
How to Growth Hack Pinterest
I wonder if we can squeeze coins out of it.
Palantir Sues Major Investor Over Alleged Theft of Company Secrets
If more startups allowed remote workers, would the salaries of developers fall in the bay area?
As opposed to immigration law and trying to convince people to move to some of the most expensive areas in the world for a sub-market salary and a lottery ticket?
Website Copywriting Guide for Those Who Don't Know What to Say
I'd argue that as far back as the 30's European manufacturers were making cars every bit as good as those made in America.

That said, they were and are made to a different design ethos - American cars have never been designed for balanced performance like German cars have, they instead have been designed for comfort and trouble-free operation (meaning next to no maintenance). America long made the only car in the world that could go 100,000 miles with nothing but fluid changes, and other wear items. No European car can really do that, all of the German makes have a pretty aggressive preventative maintenance schedule.

Japan to an extent does build cars to the american ethos - they build to the American ethos, but localized to the Japanese market to a greater or lesser extent -but then again they were taught car building by the Americans after WWII - which is I think why Japanese cars have been so successful in the American market.
But what does the attack get you? Sure you could mine empty blocks and double spend, but that would hardly be worth the investment. Besides, if payment processors detect the hashing rate doubling overnight they can simply require more confirmations.

If a nation state invested in permanently disabling bitcoin that would require a big investment in ASIC's, at which point I imagine a bitcoin fork would be introduced with a slightly different PoW, but that's just speculation.
Facebook's News Feed creators knew they were on to something big
Oil slips toward $47 as hopes for producer action wane
There's some use to this metadata, for example gps coordinates to locate where it was taken, author info, camera parameters, etc. It might not be needed all the time, but it probably also shouldn't be stripped off all the time.
Sanford Brown (or just Brown)? Same here... I loved it and it got me a great job.

Is it prestigious? Nope. But it got the job done and I was done in 2 years.
The code generation, especially on RISCs, has improved pretty dramatically between 4.8 and 6.2. You can expect to get better code size with a newer toolchain.

That said, there's a good chance it's not too hard to forward port the patches; I'm not aware of any major rearchitecting between 4.8 and 6.2, then again maybe there's been one.
I read the Adria Richards story and I felt no fear about someone overreacting to anything I'd say.

Why is this? Because I don't think women are irrational or prone to overreacting. I'm not afraid of interacting with women in the workplace because I don't think there is anything to be afraid of.
> My lead developer, Krypton-Dev, remains anonymous. I have known him and yet not known him for over two years now. Ironically, he is one of my best friends and the person whom I trust the most, by often placing the entire success or failure of Krypton in his very capable hands.

> Just two days ago, I did this very thing, trust this anonymous friend with not only my business and entire life savings (don’t get me started about using personal funds to found a startup!) but, also with the investments of everyone holding Krypton’s blockchain coin, KR.

> In a single sleepless night, Krypton-Dev coded this POS blockchain and Windows and Mac wallets for KR to be moved to. Can you understand why I trust this man with my business and KR holder’s investments? My admiration for his tireless dedication to Krypton knows no bounds.

Holy shit this is hilarious. My understanding from this article is that the founder is not a programmer, barely understands the technology, gave her life savings to someone she knows only as an online alias, who then used it to develop their own crypto currency, and thinks that a client rewrite in C will solve all of their problems. This is truly amazing.

Also, she considers this online persona her best friend. The founder is so far out of her depth, so naive, it hurts me to even consider that someone like this exists. The blog post is painful.
How is the non-profit school system "inflexible"? You don't have to attend a major research university at all, let alone for your first several years worth of credit hours. There are more than 1,500 community colleges in the US, with flexible scheduling and costs per credit hour that are a fraction of major schools.

The marketing notion that the options are solely UCLA or ITT Tech is part of the problem with for-profit colleges!
Most schools will let you test out of pre-reqs if you get the right people on board. I've never heard of a school accepting prior learning as credit hours.

If that were the case anyone who figures out what they want to do and starts doing it in high-school would test out of a year or so worth of classes right off the bat. This would be particularly prevalent in STEM where there's a lot more test and "prove you know the material" based assessment compared to the humanities where there's more emphasis on producing a particular volume of work that meets a particular quality benchmark. Lots of STEM programs would be financially screwed if they couldn't bankroll themselves with huge freshman classes full of people who will change majors.

I got the ethics requirement for CS waved. I was a transfer student who had taken two semesters of business law, two security management courses, one class on computer and Internet specific law and crime and even then it was an uphill battle. After that they reworded the requirement to drop the "or take a series of comparable classes and obtain approval by the department" clause. My observation was that being as mostly dependent on tuition bred a "fight for every penny" attitude like you'd see in an insurance company which obviously caused a lot of inefficiency.
World's first flat-pack truck revealed
ManageWP Joins GoDaddy
Rust: Systems Programming with a Safety Net
Bitcoin is coming close to having a 51% problem (3 mining groups could join together to get 51%). At recent points in the past 2 groups have been able to hit 51%. If bitcoin isn't big enough for 51% to be a serious possibility, who is?
I have used Jenkins, TeamCity, Bamboo, and GoCD. As with any tool, misconfiguration and lack of ops involvement is going to lead to clueless implementations. One might as well say "I granted everyone admin access, and they are able to run any command now".

For all these tools, there is documentation on how to lock down access to the server, and also how to run the agents under various users accounts. On my current engagement, for e.g., I ensure that the various GoCD agents run as low privileged users, with access granted via sudo.

Further, running commands directly is easy. But a better pattern is to push these commands into a script, to check in the script into version control, and to then check out and run that script. At least GoCD is opinionated that way by enforcing that users use "materials" (which could be a checkout from a revision control system).

GoCD enforces something called a "sandbox", where the file references are restricted to only the working directory for that particular job. If one needs to access files outside of this sandbox, then one needs to explicitly invoke a shell - after which point the admin/script owner is responsible for what happens. This is because the GoCD admin/script owner permitted either a command interpreter to be invoked directly, or the script owner did so within their script.

I now-a-days deliver scripts as Ansible playbooks using GPG signed RPMs, the execute the Ansible playbooks in local mode.

The non-salted SHA1 passwords is a good report. GoCD lets uses specify either an htpasswd generated file, or an LDAP source. On enterprise implementations, I always link GoCD to an LDAPs source and manage the credentials there.

In short, if one doesn't read the documentation and just implements distributed orchestrators with zero ops sensibilities, then such WTFs of being able to execute any command would of course be possible.
AFAIK Google doesn't use this data for indexing or SEO purposes..
Looks like you're missing a link. Could you provide it please?
300/320.000 is 0,09%, and not 0,00009% .
You could do that on the client side too though. Have the clients refuse to long-term pin anything until they've seen it multiple times over multiple days.
Postgres isn't written in standard C. It's written in a derivative of C where signed integer overflow is defined as two's-complement and the strict aliasing rule is removed. Most standard C compilers also support this variant language with the compile options -fwrapv -fno-strict-aliasing.

https://www.postgresql.org/message-id/1689.1134422394@sss.pg...

If you're going to use Postgres as an example of writing secure code in a language, that's fine, but make sure you're advocating for this C variant and not for standard C. Standard C, where signed integer overflow is undefined and the strict aliasing rule exists, is extremely hard to write secure code in.

http://blog.regehr.org/archives/1307

(There's also the separate issue that most of the input paths into Postgres are trusted in some way: you don't expect malformed database files, and you often don't expect hostile queries. It's primarily the auth code that needs to be rock-solid, which is a relatively small piece of the software.)