skysight-inc/HackerNews huggingface dataset:
Companies calling themself startups after 2 years of trying to find their market or get into one, just to pay you below average, make you work overtime, because if you don't they can't turn the ship around...are just too common. I've been there a couple of times.

It's almost always between bullshit promises of 'we are this close to go through the roof' and asking you to take a 20% cut on your salary, because everybody is, and at the same time bringing in new people every month.

They call themself startups, but they are not. They are businesses hanging on to straws, because of narcissistic people unable to admit they failed.
So if I say that the Saudi government and their practices which stem from their culture are bad because they kill gays, kill non believers and enslave women then I'm being racist?

Well then I guess I don't have to care if I'm being called a racists because you've made it into a good thing.
Sharpen Your Pencils, It’s Time for the #EmailIQ Trivia Contest
Two quotes:

1. "Amazon doesn’t count shipping costs for its own products, or those it fulfills for others, when customers rank a product by “price + shipping.”"

2. "Amazon said: [..]The sorting algorithms [..] are designed for that 90% of items ordered, where shipping costs do not apply.”"

This is not just misleading, this is a step beyond. It's a big company, it should take care of its customers and if it does not, customer protection agencies should go after it.
China’s orbiting quantum satellite links with ground stations
I am deeply sorry - Oculus Rift founder Palmer Luckey
Berlin has had a nasty culture in its labour market for a long time. People working low paying or even unpaid internships to get a foot in the door would get sucked dry by digital and advertising agencies. I knew people in their mid 30s still technically being student and working in their 10th or so internship position, never making it.

Where I worked, the way us junior people were treated was horrible, and I declined a full time position after completing my vocational training because of it.
But talking to my mates in the industry back then we all encountered similar shitty exploitative attitudes.

I left in 2004 and have never looked back really.
Like Gladys Kravitz on Bewitched. [1] [2]

[1] http://bewitched.wikia.com/wiki/Gladys_Kravitz

[2] https://www.youtube.com/watch?v=-mdFctlvB3w
Ask HN: Have you ever visited example.com?
Sorry if this seems a bit pointless, but for the first time just now I visited https://example.com/

Expected to find the typical "spammy" parked domain page, but instead learned this:
http://www.iana.org/domains/reserved

Had no clue about reserved domain names before today! You?
Ha. This is just the normal process of growing up and understanding how companies work. If you are disillusioned once you have see behind the curtain then it is time to find work that is meaningful to you, not just buying in to the traditional thinking on startups.
Marc Andreessen takes a break from Twitter, deletes ~100K tweets
This is a sensationalist title thrown onto a rehash of the real article, which can be found here: https://www.propublica.org/article/amazon-says-it-puts-custo...
Getting your picture of the world through media means getting it from examining the extreme outliers? I don't have data, only a suspicion, this is relevant if it can be shown that people get much more information about their world from media than they used to, and/or that the media has turned more global, meaning less local reports but fishing for extreme stories in the wider world. This could explain why (if) the image of the world, including the local world, has become more extreme, which could in turn explain more extreme and less relaxed attitude(s).

In addition though, I think a contributing factor is cars, cars , cars everywhere. Having grown up in East Germany, I would be much more concerned about letting my kids (if I had any) roam around in the exact same area where I grew up in very freely. The roads are much more dangerous now for inattentive playing children. And as a local issue, a vastly increased number of ticks in the forests around my childhood home, but as I said, that's just a local issue.
> I would disagree with your second point though. If you take a look at the search query data you will see that over 80% of the searches come from where users have typed less than 2 words in length. Only a small number of impressions are coming from searches that are 5 words or more in length so even if you had 1 million 5+ word keywords you would never be able to get the same number of impressions as you would with 2 word keywords if that makes sense.

No, it doesn't make sense.

10k 2-word keywords: 1M impressions/day

10k 5-word keywords: 100k impressions/days

If I now increase the number of 5-word keywords to 100k, what do you expect will happen? I expect to get abobut 1M impressions/day
How do they tell the difference between passengers and drivers?

How do they tell the difference between cars and buses?
Exactly. And similarly, Iraq only had 150k US soldiers, so it was actually much more dangerous than Chicago. Which is why Kanye West's comparison is nonsensical.
Krzysztof Żuraw: Archives from memory- libarchive
Edit(2): One thing I wanted to mention[..], Calhouns universes, you have to read his prominent papers to the end otherwise you might get depressed(it gets more optimistic towards the end) - sustainability of societies even without resource-limits _is_ possible
I also can't believe that this is true. Even if you were someone that ignores the dignity of your wife (which I doubt Indians do) she still would suffer from all kinds of illnesses if she had to do this, so it doesn't make any sense. Maybe some crazy guy somewhere does that but that can't be the norm anywhere.
I was once advised:

1. Don't be afraid to skip parts or start from the middle and jump around

2. Don't worry too much about it all fitting together - each small part is enjoyable even if you're not following that larger structure.

Basically open a page at random and revel in it. It's potentially a lot of fun to read.

I'll hasten to add that I personally haven't followed this advice. I gave my copy away before hearing it.
No, I was on the paid tier. If you're talking about September 2016, maybe. I was talking about 2015, being just an example of how Google's support was unhelpful.
Show HN: Cursor that Screenshot
Working as a freelancer with a couple of startups, I would like to share that they are really, really struggling with their employees ( dev. teams ).

IMHO, they have unrealistic budget & business expectations for most of the developers. Because of that employees' burn-rate is really high and they switch jobs very often ( 6-8 months ).

New talent comes form mostly eastern Europe, but since it's obvious after 2 weeks working and a couple of tech events that you might find a better job ( maybe salary! ), they usually don't stay loyal to their first employer and quit within 6-8 months.

Now I see another flow of startups hiring people from countries that need VISA to work here. Which again sounds like another way to keep the employee ( will have more difficulties fixing papers if he/she quits ), without improving your business strategy. Anyway don't have any insights about this case, since I don't have a lot of friends like that in my network.

Also not every startup is look-a-like, but almost no startup will give you individual salary based on your experience level ( they usually will determine the paycheck by the position that you take +/- 10% ).

Nevertheless for a freelancer, Berlin is an awesome city to work in!
Easily add a cursor to your screenshot using just a simple web app.

Any feedback is appreciated!
"Coding" isn't "brain surgery" or "structural engineering". Notice how he had to go deep into the hardest parts of those skills to find something that was deadly and dangerous, but compared it to the most basic version on the other side?

Being a doctor is fun, and "making things" is easy. Coding is also fun and easy. Coding the OS for the space shuttle shouldn't be taken lightly.

But I'm betting that neurosurgeons really enjoy what they do (fun), and I'm betting that structural engineers do find lesser engineering to be "easy".
Ask HN: Are Americans really ready to give up their cars?
I keep reading these autonomous car articles, like the following link, that extrapolate the future impact of autonomous cars. I think the authors of these articles are over-reaching.

https://medium.com/@DonotInnovate/mind-blowing-driverless-future-fcc5197d509#.scx3famc7
Why always the focus on free Wifi? Germany, like most of Europe, has good 3G/4G coverage. Rates are reasonable, so you can provide your own connectivity. Far more cheaper than renting a space just to get free Wifi.

That doesn't mean that the German laws about liability for offering connectivity don't suck.
There is a saying that you can only manage what you can measure, but the problem is then, you only manage what you can easily measure. It's easy to tick boxes for gender, sexuality, race etc - but if everyone you hire is a 20-something graduate of the same top 10 universities, from the same socio-economic class, having sat in the same lectures, read the same books, been exposed to all the same ideas, buys the same brands, has the same hobbies, then how can the benefits of diversity be realized? I believe nearly every high-profile product flop from major tech firms can be attributed to this.
That means Trump must be a good father, because he never takes his eyes off his daughter.
I realize Krebs seems to be using Shield, not vanilla GCP, but I'd like to know the answer to this as well.

Krebs' article describes two attack methods, fake HTTP requests and a simple volumetric flood of GRE packets. L7 mitigation clearly isn't part of GCP's service. The GRE packets should be a different story -- if the customer isn't using GRE, they should be able to drop this traffic easily using the GCE firewall or GCE load balancer.

The vulnerability report at http://www.securityfocus.com/archive/1/532239 suggests the GCE firewall is, or at least was as of May 2014, ineffective against such an attack (even if your firewall rule set will drop the problem traffic). But it also says the GCE load balancers do not have the same problem. Krebs didn't mention how much of the 600+ Gbps was GRE, but let's say a GCE load balancer was configured to pass through only TCP/80 and received 100 Gbps of non-TCP traffic. Would the load balancer function as intended and drop all of this with no interruption to legitimate TCP traffic, would Google null route you, or something else?
Downvotes?
It's a different programming model that you'll have to learn. It will take you a week or two to become proficient. It's not mainstream but instead based on a time-tested abstraction. The docs are top notch when you include the book, but they are not spread out over multiple sources. It's doing cooperative multi-threading, so if you have software that doesn't want to cooperate you may experience problems with fairness. It's [pull-based/cold/sync/rendezvous based], not [push-based/hot|cold/sync/scheduler-oriented] (rx), not [pull-based/cold/async/non-deterministic] (F# async), not [pull-based/hot/async/non-deterministic] (TPL) so you'll have to start thinking about what concurrency and parallelism means for you.
i would say making secure tunnels a default for home routers would be a better mitigation... there is no need to control my "smart home" or what ever from my neighbors phone...

Some things just do not make much sense without being able to control them remotely. A separate VLAN for devices would only allow them to communicate with another which probably is not what you want. BTW. i could not set up VLANs on a fritz box with FritzOS last time i tried. However nearly all routers with OpenWRT will do without a problem.
This is great reading, and helped me clear up a few misconceptions about how SFINAE works. I really don't understand the negativity here.
Aren't Vonnegut, Heller and the magical realists all post-modern? And eminently accessible...

Joyce is surely an arch-modernist. Not so sure about Pynchon.
FWIW, this is why I use lua as my primary language: it's the only language I can keep all in my head at once.
Android already natively has a similar feature (at least in the last versions, not sure about kitkat and lower). So how does this app improve on that ?
I disagree. A startup should at least have a draft business model and also a startup should make sane investments in its personal (I rather dislike the word "human capital").

Just burning people like burning money to someday find either a big buyer or a sane business model -- really looks rather insane to me.
I don't think this is a serious project anyhow. They've basically just made it so that you can write JSON instead of HTML and given it a live reload feature. It has all the pain of HTML with the pain of having to convert that into JSON in your head added to it, with the only stated benefit being that you can live reload, just like you can already do with certain development servers for HTML and Javascript.
> NASA captures change in temperature of dust around a singularity, finds additional evidence in support of dust hypothesis.

> Photo: before / after. Notice center pixel value changing from #030202 to #020203 as dust warms.

Yep, that headline and image will get lots of shares on Facebook. Let's just roll with it, and skip the A/B test.
Some domains are not to be sold, to avoid domain squatting and the kind of spammy websites you were expecting.
Thanks, I'd expect it to have some bugs (it's a much newer project than GCC, and even Python or Perl have lots of open bugs), but was missing the second information that Mike gave up on it. Last time I checked (a few years ago) it was still going forward.
*rite

(sorry)
Hear! Hear! Let's all join RMS in his anti-natalism pledge, and set a better example by making proud announcements that we don't plan to reproduce ourselves! [1]

[1] http://www.art.net/studios/hackers/hopkins/Don/text/rms-vs-d...
I've always wondered just how much a network run by someone like Google or Facebook or one of the other absolute top tier providers like AWS or Azure might be able to 'handle' in terms of dealing with DDoS attacks.

Presumably these giants can easily handle such traffic as long as someone is willing to pay for the privilege? 665gbps seems tiny in comparison to the capacity someone like Google might have at its disposal but I'm speculating as I haven't seen anything detailing their network stats.

To give something of a concluding statement to this waffle I guess I have respect for Google in running this public service type protection for sites that have a strong enough 'public good' element.
My advice is not to bring it up. Most of them aren't even going to consider it. They'll think that just having the code will be enough.

Of course, you should document things when appropriate, and your code should be good, clean, and maintainable. It's what they're paying you for.
> PUC lua is probably the fastest traditional scripting language

That really depends what you are testing for. For string ops is not the fastest. For recursive Fibonacci (inefficient) LuaJIT is faster than D and Lua is faster than Perl.

http://raid6.com.au/~onlyjob/posts/arena/
Majority of bikes we sold at our shop cost around 200-300 USD for us to purchase (retail price would be around 2x that).
This was in expensive Norway, and there were plenty of generic sports stores that sold bikes at down to 1/2 of what we did. So for to-retailer price in US, that 120 USD does not seem too crazy.

Don't forget that "good bikes" are actually very rare, especially if counted in volume (not price).
amen. i can attest to that. but the entire city is a big shit show.

in startups i've seen it. countless low-pay-workers (students who need money) who do useless shit all day. devops who actually do 2 jobs for one salary.
ceo's feeling special drowning in certain circles or think they accomplish sth when one of those useless shithead ministers come and look around, talk lies about how they'll improve investmemt regulation.

this city is one giant tourist multi cultural smoke screen.

there's not even one club playing good music (that is, music of my taste). everywhere it's all just weird electronic or rock/pop crap mixed by dirt cheap dj's who take the word "mix" too literally.
- Is it better to use a different passphrase on each key, or does using the same one not matter much?

Yep in an ideal world, though I suspect in practice it doesn't matter much.

- How much less secure is it to not use a passphrase on a key?

You are relying completely on the security of your disk, against either physical or cyber. Use a passphrase, use an agent to manage it.

- Should you use a different key per user account, per server, or per use-case (i.e. personal or work)?

Per client device. This is the device that can be compromised and cause invalidation to be required, so this is the one which should be seperate. For convenience you can maintain all your devices public keys concatenated together and hand them out like that - comment each with hostname and date created for ease of identification.

- Does increasing the amount of bits in a key really have an effect on the security of the key, or does it not make much difference in a real-world use?

Up to a point. RSA in 8 bits is trivial. Go for a highish key length, different key types have different recommended lengths. Note some machines dont support higher lengths.

- How/Where should private keys be stored on a device using them?

In $home/.ssh

Permissions should be set for only you to read with no writing. Even better if your home drive is encrypted as it is only vulnerable whilst you are logged in.

- What are some of the pros and cons from a security standpoint, and how may doing different things affect the usability of a key?

If you hop machines a lot key per client can be problematic. In this case a portable secure drive is useful. Of course one leak can be fatal here.

Try not to fall back on passwords, they have nothing like the same security.

Most usability issues are caused by the people running the servers not reacting in a timely fashion to key updates.
Surely they do teach just that?

Whenever I write a report I always put the summary first because that is all that anyone who trusts me needs to read. The rest is supporting information and extended arguments in favour of the proposition that I make in the summary together with some notes about why alternatives are no good.

Of course, I never went to business school, I'm an engineer who started as a physicist.
I own Pepper :-)

I know that when Maarten was developing it there was some attitude, as you say. I think Maarten really wanted to succeed and make the best editor out there. Pepper was amazing, thus why I bought the source. Maarten is a fantastic person. We still e-mail periodically. Being a one man indie-dev is hard. Especially when you support many platforms. I think it just got to be to much.

This is partially the reason I stopped development too. 200+ e-mails a day, sales were ok but not enough to quit my job or pay anyone, sales through PayPal and Kagi turning up with stolen credit cards and Paypal and Kagi taking money back from me.

I still use Pepper daily and add new features. I could surely give Sublime and Atom a run for their money. Pepper does a lot more than it used to and you can even write plugins to enhance it.
3g/4g rates are a joke. i call robbery. ever been outside germany?
The consensus here seems to be that DiIorio got what he had coming for trading in the pink sheets. Fine.

But if we accept the premise–that a market maker in penny stocks can sell an essentially unlimited number of shares without ever having to close out the short position–doesn't that mean that there is absolutely nothing a private investor, using a regular brokerage account, can do to protect themselves?

So the point doesn't seem to be about DiIorio's due diligence (or lack thereof), but that this can happen with any penny stock absolutely regardless of the level of care an investor puts into the trade. If true, it seems to call into question the regulatory policy of letting non-qualified investors trade in these things in the first place.
total nonsense.

25519 is an asymetric key using eliptic curves
And this video shows how the procedure is performed, and clearly demonstrates its effectiveness: https://www.youtube.com/watch?v=LNJi0zfodI
Much more lighthearted take on the same issues in Berlin. It's brilliant. https://www.youtube.com/watch?v=e22vY4CWpEI
I like startups, because they are a way of bringing new thinking into the world, where dinosaur corporations rule.

But there has also settled some notion today, to make making startups like having an assembly line. It is no more about having new ideas or about solving worlds problems -- it is solely about burning more and more cash and making new cash-cows from it. The idea itself, the customers and the people working on it, have become second nature.

All of it is of course hidden by a geeky, hip culture, where everybody can feel fine -- if he does not think to much about it.
I consider best practice to be using a hardware token.

My favoured solution is to use a yubikey via gpg: with this method you use your gpg subkey as an ssh key.
The yubikey 4 supports RSA 4096 bit keys, if you need NFC then the Yubikey Neo supports max RSA 2048 bit keys.
Eddie is written by Pavel Chisler(?). I don't know him, but I hear is a great developer.
For this case it'd be justified (it even has lambdas!). TMP is great for data-centric code though, like math algorithms or data structure definitions with optimizations conditional on type traits.
I'm a little too lazy to create an account in which Amazon Prime is not enabled, so I'm looking at listings in Incognito mode (i.e. not going through to the order confirmation screen, which requires creating an account).

In the ProPublica article, the example of Loctite Liquid glue is used:

https://www.amazon.com/gp/offer-listing/B004Y960MU/ref=dp_ol...

The first listing is indeed from Amazon.com as the seller. It has the cheapest price at $5.97 with "FREE Shipping" if you have Prime. So I assume that without Prime, there is a cost for shipping.

The next listing is as the ProPublica article claims, from "TheHardwareCityCo", with a price of $6.75 with free shipping.

Assuming that that free shipping, unlike Prime, is unconditional, it is worth pointing out that TheHardwareCityCo offers a shipping date from "October 3-12". I'm assuming that you also don't get the return guarantees that you do from Amazon.com.

Furthermore, the massive markup cited in Quartz/ProPublica -- $1,400 extra for buying a basket of the 250 most popular products -- only applies if you decided to buy each item individually, as Amazon automatically gives you free shipping (Prime member or not) if you buy $50+ worth of items.

Not seeing the big problem here, to be honest. Frankly, I get annoyed when the default seller for an item is not Amazon, and I have to dig to find the listing that has Amazon as the seller. I have Prime, so that makes a big difference, but I prefer Amazon's reliability over spending time trying to figure out which third-party seller is the least shadiest.
"Basically, the only way to "securely" operate IoT devices is inside a separate VLAN."

This is a major pain to configure, and way beyond the capacity of even most IT professionals. One of the problems is that you do want to allow some devices (phones) from the 'normal' network to (selectively) be able to connect to devices in the IoT vlan.

I spend a solid day trying to set this up once (and on a 'real' switch, not a Fritzbox which I have too but only use as modem) and I'm not saying that I'm that good a networking guy (I mean, that I wasn't able to it working means I'm not) but I do know more than the average internet installation guy who would be the only hope for 'regular' users to set up their networks properly.
> What jobs?

My first thought was "What games?"
$ dig www.krebsonsecurity.com | grep IN
;www.krebsonsecurity.com. IN A
www.krebsonsecurity.com. 267 IN A 127.0.0.1