skysight-inc/HackerNews huggingface dataset:
Quick reminder that verified code is only hacker-proof provided that:

a) The specification correctly describes all correct behavior and correctly proscribes all incorrect behavior (basically, you trade a huge codebase for a smaller one in the form of the spec, which is a massive improvement, but as long as humans write the spec it is not clear it can ever be fully hacker-proof)

b) The trusted computing base works as modeled in the spec. Even on the limit, that means that the physical properties of the hardware are as we expect them to be and that our understanding of the laws of physics is correct. Slightly below this threshold there are things like Row Hammer attacks (https://en.wikipedia.org/wiki/Row_hammer ). Before even this: microcode bugs, proof-verifier bugs, etc.

That said, formal methods do provide a huge improvement over the state of the art of completely unspecified software, and have been shown to work in practice to greatly reduce the number of vulnerabilities of important large systems such as compilers, kernels and now remote controlled helicopters. They might not be appropriate for every piece of software quite yet, but I would greatly like to see this stuff for things like self-driving cars, airplane autopilots, smart grids and smart factories and in general all of the rapidly approaching "heavy" IoT applications. Also, some verified properties of commodity OS would be very nice to have (say container isolation in a cloud environment or non-leaking of keys for a smart wallet process).
I feel you. Had to migrate to IPSec, luckily there is a docker container that makes things a little bit easier.
Graphs have been updated.
I think the biggest issue is from a business people perspective, formal requirements needed for this type of development (software development as an engineering discipline) is too slow, and not as open to change as the agile (craft) methods tend to be in software.
Are there chains of Sophie Germain primes?

e.g.,

p is prime
2p + 1 is prime
2(2p + 1) + 1 is prime...
Plenty of nations with high federal government spending do fine, plenty of nations with low federal spending do badly. On the whole, high spending is correlated to better outcomes.
At this point, your baseless bias against Tesla should be clear to yourself. If you can take this revelation with humility, that you have been advocating against the exact thing that humanity truly needs, I declare you in the top 98% of people for emotional self-control. It is not an easy thing to accept that you're wrong, but I've spelt it out.

And we need your help, stranger, because time is running out super fast and there are millions out there making the same misjudgment that you have here, but some of them are a genuine threat to Tesla's fate.

It is a race against the clock to get everyone behind this guy.
ICANN could just fund the whole thing.
You could probably sell them even though you revealed how you did it.
Counterpoint: It did for me.
Many people aren't building websites. They're building applications which target the cross-platform runtime and APIs provided by modern web browsers.
Is it pure Go? Could you compile with GopherJS and do the processing all client side?
> Apple ran (runs?) their own advertising service for mobile apps, iAd. I'm not sure the status currently.

They shut it down quite a few months ago.

Before that iAd was pretty restricted because of Apples privacy stance:
https://9to5mac.com/2015/07/14/iad-user-data-privacy-policy/

"Former iAd exec leaves Apple, suggests company platform is held back by user data privacy policy"
there is nothing really that is free beer in the world, the money has to come somewhere, either some "rich" guys donate the fund, so the rest gets a free ride, or everybody pays a little, say, $5 per year, what's wrong with that? I'm not a rich guy per se, but I want to pay reasonable fee for what I got.
To save others time. I've copied some of the biggest points of the article. My comments are in [brackets], except these^^ first few sentences.

"Between the lines it takes to write both the specification and the extra annotations needed to help the programming software reason about the code, a program that includes its formal verification information can be five times as long as a traditional program that was written to achieve the same end."

"Jeannette Wing, corporate vice president at Microsoft Research. “Any natural language is inherently ambiguous. In a formal specification you’re writing down a precise specification based on mathematics to explain what it is you want the program to do.”"

"“We’re not claiming we’re going to prove an entire system is correct, 100 percent reliable in every bit, down to the circuit level,” Wing said. “That’s ridiculous to make those claims. We are much more clear about what we can and cannot do.”"

[In the experiment the article is mostly based on]
"The hackers were mathematically guaranteed to get stuck. “They proved in a machine-checked way that the Red Team would not be able to break out of the partition, so it’s not surprising” that they couldn’t, Fisher said. “It’s consistent with the theorem, but it’s good to check.”"

"In a return to the spirit that animated early verification efforts in the 1970s, the DeepSpec collaboration led by Appel (who also worked on HACMS) is attempting to build a fully verified end-to-end system like a web server. If successful, the effort, which is funded by a $10 million grant from the National Science Foundation, would stitch together many of the smaller-scale verification successes of the last decade. Researchers have built a number of provably secure components, such as the core, or kernel, of an operating system. “What hadn’t been done, and is the challenge DeepSpec is focusing on, is how to connect those components together at specification interfaces,” Appel said."
> “We’re not claiming we’re going to prove an entire system is correct, 100 percent reliable in every bit, down to the circuit level,” Wing said. “That’s ridiculous to make those claims. We are much more clear about what we can and cannot do.”

This is an important statement that should be highlighted more prominently in the article (whose title I disagree with).

Formal methods are promising, and I'm glad that the researcher acknowledged that when your project relies on so many other abstractions and systems it doesn't matter how rigorously developed your solution is if a hacker can find a way to accomplish their objective through one of your dependencies.
Assuming the salary cost scales with the skill of the employee linearly and assuming that 25 people causes extra management overhead I would say no.
Update: EFF Fights to End Court Case Against MuckRock
Try this:

http://www.economist.com/news/science-and-technology/2170718...
Non-standard with respect to what? It's used in every Apple app, as well as tons of third party apps — Facebook, Instagram, and Gmail to name a few.
Deviceatlas go wrapper
Hi all,

I am working for DeviceAtlas, the mobile detection solution and know some users of the C enterprise API available here https://deviceatlas.com/deviceatlas-haproxy-module were wondering how to integrate it inside golang. Can be taken as it is or at least as an inspiration as I m not necessarily a very skilled go developer but if it can help a little, why not !
Ads for your own content are still ads. I just want to watch 20 minutes without interruption.
I was gonna say, i think of all the arguments one can make, this is pretty much the least viable :)

Once the web became mass-market, standards pretty much became a complete mishmash in every area.
Right now the initial library is a private repo of mine on github, but yes, the plan is to make all components open source in the near-future, to encourage active development + security transparency. I'd also like to eventually extend/refactor the node.js signaling server into a federated model.
I disagree because the <amp-ad> tag [1] supports many non-Google ad networks. It doesn't force you to use Google's services at all.

It seems to me that they used this particular approach because best practices are a lot easier to ignore or misinterpret than AMP's "your page will literally break if you try funny stuff". It's why something like TeX was invented rather than releasing a "best practices" package for making Word documents.

[1] https://www.ampproject.org/docs/reference/extended/amp-ad.ht...
Specifically, hardware level exploits are wholly disregarded by formal verification. This means bit-banging could still work. In many systems I'd also be wary of the OS itself.
As great as TypeScript is for enforcing certain guidelines for your own code, it does not provide much in terms of supplying polyfills so certain browsers can support some ES5/ES6 features. If you're working with the cutting edge of browsers it shouldn't be a problem, but if you need to go back a couple of years, you either need that or at the very least core-js.

Even the ECMAScript feature table (https://kangax.github.io/compat-table/es6/) uses Babel and TS with core-js when comparing features, otherwise it'd be heavily browser dependent.
Binondo, World’s Oldest Chinatown – Chinatown Report
Advertisers (as a whole) have a veto on what advertising-driven websites can do since they write the checks. So I think the idea is that it's a compromise that users, websites that depend on ad revenue, and advertisers will all accept, since they all get something they want. If any of them are too unhappy then the new standard won't succeed.
You're right, we probably should be celebrating our lead tainted water, fracking, telecommunications monopolies, $300 Epipens, unaccountable financial institutions, pipelines across native land, corrupt campaign contributions, infrastructure decay, lack of decent health care...
Thank you! We updated the submission.
Western Digital Shows Off Prototype 1TB SDXC Card at Photokina 2016
Wowza Media Streaming Engine Announces Support for WebRTC (Beta)
My advice is that you should consult a lawyer qualified to give you advice.

The immigration agency are not your lawyer.

Immigration is super complicated. Everywhere, for everyone.

This is your livelihood we're talking about.

Go see a lawyer.
The new smart card support is pretty cool: https://news.ycombinator.com/item?id=12543905
I Google'd HACMS project and found an Open Catalog page at DARPA with a bunch of links to open source software and paper PDFs.

Seem worth checking out to anyone whose interest was piqued by the article.

http://opencatalog.darpa.mil/HACMS.html
A-ha! Normally I'm used to these apps proclaiming their Free-ness on the front webpage, but it didn't jump out at here. Much thanks for the linK!
Mastering the Basics – Choosing the Appropriate Tools, Methodologies, Frameworks
"no null result, no complete experimental failure"

Well, here, have a look at all the nice excluded theories.

https://twiki.cern.ch/twiki/bin/view/AtlasPublic/Supersymmet...

https://twiki.cern.ch/twiki/bin/view/CMSPublic/PhysicsResult...

And here's Michael E Peskin (of the Supersymmetry Working Group) quoted on the late 2015 results:

http://www.nature.com/news/lhc-sees-hint-of-boson-heavier-th...

"To theoretical physicist Michael Peskin of the SLAC National Accelerator Laboratory in Menlo Park, California, the most relevant part of the talks concerned the failure to find a supersymmetric particle called a gluino in the range of masses up to 1,600 GeV (much farther than the 1,300-GeV limit of run 1). This pushes supersymmetry closer to the point at which many physicists might give up on it, Peskin says."

The "not even wrong" label does not actually apply to your impolite comment; it's just wrong.
I agree that domain knowledge is essential. Without domain knowledge, testers may spend way too much time testing insignificant scenarios which a user would be very unlikely to perform, while missing obvious problems that every user would run into.

Overall, my experiences with testers has been positive. As a developer under constant time pressure, it's very easy for me to make stupid mistakes that end up causing grief for users. Since unit tests (or any tests written by a developer) can only test scenarios that the developer has actually thought of, it's good that someone else is testing the product from a user's perspective that's not biased by preconceived notions of how the code should behave.
The title of the actual article seems to be completely wrong. It doesn't look like he shared any private keys.

User The_Raging_Goat on reddit explains what is bad about his posts though:

"All but one of those IP addresses on that post are reserved as private - meaning they are only used for internal addressing. Many brands of commercially available routers will also hand out these same 10.1.x.x IP addresses to your computer, and is functionally identical to the 192.168.x.x IP range. Basically 10.1.x.x will never be used as public IPs that any ISP can issue, so if you ever see that, it's not revealing anything at all. Unless you have the boundary IP address...

Which it appears possible he publicly handed out. The one IP address that isn't a private IP address, 23.24.145.45 is a static IP address issued by Comcast Business, and that IP range covers Colorado Springs and Denver. Given what they are talking about (VPN), it's likely that IP address is the entry-point into Platte River Network's Colorado based location. Now, that's not necessarily hard to figure out for someone trying to get into that network, IPs aren't exactly private information.

However, that's not the bad part. He confirms that very easily compromised protocols are open to his boundary (which he conveniently provided). That is dangerous, and speaks to his incompetence, and the general incompetence of the company he works for (PRN)."
That is completely untrue. While the BSD syscalls are supported, Mach syscalls and Mach IPC are also heavily used, especially internally at Apple.

Just one simple example: run "sample <process>" (where <process> is any Cocoa application) on OS X. Pretty much every thread will have an event loop powered by CFRunLoop, and they'll all be stuck in mach_msg_trap waiting for an event to occur.

Also, pretty much any sort of semi-complicated IPC on OS X is done over Mach IPC (e.g. passing a large bitmap copy-on-write from one process to another). Take a look at the ipc directory in the Chromium source, for example.
How would integration with Windows Phone be "useful integration" compared to other efforts when Windows Phone has 1% market share?
An artificial intelligence made of wooden drawers and coloured beads
My guess is someone like Google would come in and fill the spot for free or very very cheap. I think Google/Microsoft/Apple/etc could donate the 10+ people they need without even batting an eye.
That would be cool. It is pure Go...
Even text messaging on multiple devices is a disaster. If I have Skype running on a PC and an iPhone, the phone app will almost never receive new messages.
I'm not sure how sharing is broken. As far as I know, AMP pages render on any standards-compliant browser and have a normal URL.
Actually, a lot of manufacturing is moved back to Germany now, Adidas for example is moving all of their back.

And Foxconn buys all their automation technology in Germany ;)
I'd guess that the company-sponsors are on the hook for more than a year.
Planning to use this to illustrate my new roguelike ... pet project to learn Lua ;)
From what I know about immigration systems(experience with Czech Republic and USA), having degree is fundamental piece of your visa application. For example in US, the 1 year of university is taken like 3 years of experience, so in order to be qualified like someone who has a bachelor degree, you would have to have 12 years of proven work experience.[1]

Based on my experience with immigration systems I've worked with, it never matters how stellar skills you think you have or how many great repos you have on Github. What matter is the quality of your particular case which means quality of paper work you are providing. Obtain highly valuable certificates(eg. a degree in the field you are applying for), recommendations from former employers(C lvl management+), get published(newspaper, etc), and others. These all documents help you to pass the minimum requirements to submit your visa petition.[2]

In addition to that, every country has several types of visas. Maybe if you are not approved for working visas, you might want to try different type of visas(intern)?[3]

[1] https://www.quora.com/H-1B-Visa-Reform-Is-it-essential-for-a...

[2] https://www.uscis.gov/eir/visa-guide/h-1b-specialty-occupati...

[3] http://www.schengenvisainfo.com/switzerland-visa/
I have a couple of points, unrelated.

(1) Tabular data comes to people naturally. It's not an obscure, impractical theory foisted on us by E. F. Codd. Peer over the shoulder of your non-programmer coworkers: the front-office secretary, the project manager, the company president. You will find that each of them love Excel. They're using it for address books, project statuses, meeting minutes, and a million other things. Some might say they're abusing it, because Excel is meant for math, and they're using it just because it makes it easy to set things into tables.

(2) Organizing a complex application into tabular data is hard. Look again at your secretary's Excel spreadsheet of contacts, and you will see that it fails the first level of normalization: contact names and company addresses are repeated across rows. Changes are delicate, and the spreadsheet likely has bad data.

An application of even medium complexity, if properly normalized, will need several tables, including one-to-many and many-to-many tables. For each column, you must choose among a cornucopia of data types: boolean, integer, real, numeric, date, time, timestamp, enum, text, array, json, and several others. Furthermore, have you chosen the right constraints: primary key, foreign key, unique, check constraint, rules, trigger functions? Most pages of the app will involve joining several tables, and often there is a way to arrange it that makes it run 100 times faster. But then again, such is the case in any programming language.

So I do not blame programmers who want to reach for the NoSQL database. It is a thousand times easier to just:

save(json_encode($_POST));

or whatever. I've been programming with SQL all day long for over 10 years, and it's still hard. I'm still finding better ways to write the SQL or use features of my database (PostgreSQL) that I wasn't using, at least not as much as I could.

The biggest encouragement I can give to someone who doesn't know anything beyond

select * from table

is that writing it in SQL is almost always shorter than in your procedural language of choice. How would you enforce all these rules in procedural:

create table sales (
id serial primary key,
sold timestamp,
emp int references employees,
cust int not null references customers on update cascade,
item int not null references items on update cascade,
qty int not null check (qty > 0),
price numeric (12, 2) not null check (price > 0)
)

or formulate this report:

select emp
from sales
where age(sold) < '3 years'
group by emp
having sum(price) > 1000000
order by 1

(DISCLAIMER: The code in this post is not guaranteed to compile.)
What is the consideration?

EDIT: Actually, I just saw the "English" version of the contract. The fact that you can give the contribution to charities other than what were selected would be a deal-killer in my mind, even through that scenario is unlikely to actually occur. I did not see consideration laid out clearly. It seems to say that your providing the service IS the consideration, but that feels weak to me. It feels to me like you are saying "If you give us X% of your assets, we provide the resources to let you, and use your name on our site to market it!"

Obviously, you have plenty of people who did not agree with me. And I applaud the spirit of it all. It just seems like the details need work.
Really similar to http://pledge1percent.org/ (with Marc Benioff of Salesforce and Scott Farquhar of Atlassian backing it).

As well as pledging a percentage of your equity, they're also pushing making room to donate 1% of your product and free up 1% of your employee's time to put towards good causes, so that it's part of the culture not just a happy side-effect of a possible exit.
Oh hey, thanks chief!
Ask HN: Why don't web apps make use of right click?
I only recently found out about "oncontextmenu", which is a javascript event that fires when a user right clicks a web page. Using that event, you can prevent the OS/browser right click menu, and even create your own menu.

So my question is: why don't more web apps make use of that? A right click is an operation that's instilled in many (all?) computer users, why not leverage that instead of having complicated dropdown options menus?
Planet Money did a story on a small US bank whose owner was convinced to start offering Islamic-compatible financial products: http://www.npr.org/2016/05/12/477758545/michigan-bank-discov...
With an additional differentiation being that not only is it 61% post-consumer paper waste, but it spontaneously doubles as a heating source without user intervention!
I admit I don't know the math well so I am curious to know how to fix my intuition:

Let's say you want to figure out the unknown bias on two coins. You flip both continuously and plot the percentage of heads you see. Due to law of large numbers these percentages will eventually converge to true probabilities (which is how I am interpreting the graphs in that blog post).

The bad case is if the two coins are actually "flatlined" in the wrong order so as a pattern matching human you mistakenly believe the rates have converged prematurely. I don't know how to work out the math on this but let's say a "flatline" is visually 100 points or so with no significant slope. Then this should be pretty rare right?
> They shut it down quite a few months ago.

Yeah, I looked it up before I posted because my information was fairly old, but I found some conflicting info when I did. Some sites state it was just the developer integration that allowed developers to advertise their own apps (as an update to the story). I'm not sure if Apple still runs an advertising framework or not, and wasn't willing to dive much deeper when the first few sources seemed ambiguous and nothing official seemed to clarify.
> Most doing heavy lifting don't make SF wages or have office costs that high.

I work remotely from home and don't make anywhere near as much as someone in the valley. However, I'm quite happy with my cost of living. :)
Dietary Aloe Vera Supplementation and Glycemic Control in Diabetes (2007) [pdf]
You can get a similar effect by pressing Ctrl "-" a couple of times in your browser, to shrink the images. The result is that they look much sharper. But of course, this spoils the original effect.
Digital Checks sound like the way to go for this. Multiple YC companies like cleanly.com stilt.co are already using them. Both for collecting funds as well as disbursing funds.
Unlike ACH there are minimal on-boarding issues and UI/UX is much friendlier than ACH. Feel free to try it out at https://www.checkbook.io

Also there's an API and integrations with Wordpress and Magento. Price is a fixed $1/Check. No percentages!

Disclaimer: I work for checkbook.io
I did not know that about the cavalry charge occurring before tanks arrived (it is a little suicidal so is surprising)
Hmm. I could swear since upgrading recently that I've been asked whether an app can send me notifications. Could be wrong , I have a large mishmash of Android and iOS devices lying around the house.
Crp center маркетинг и как работать в црп
How we're going to beat hunger
You are correct, but the logic here is clearly geared towards pushing sites to rely more on google's standards, rather than actual industry standards.

The problem: We have too much cruft on sites.

The solution: Lets add another layer of cruft!

Ranking smaller/faster sites higher is a better solution, but it doesn't give google that sweet lock-in that they want.
It's 2016 and we still can't disable the acceleration curve for wired / non-trackpad mice.