skysight-inc/HackerNews huggingface dataset:
It's borderline a privilege escalation vulnerability. The default behavior is that an unprivileged user on the system with network access can get access to an instance's credentials that can be used to perform administrative functions.

Like Colin pointed out in the blog post, this completely subverts the permissions model in modern operating systems.
I'm a product designer so work at a pretty high level and have no use at all for knowing how to implement different sorting algorithms or data structures. Nor am I sure how acquiring this skill would help me at all in the development I do beyond knowing the basic properties of maps, lists, immutable seqs, or whatever else I'd make use of. And sure, if you're a JS dev you need to have a rough understanding of prototypal inheritance (though classes make this less necessary now), hoisting (though deprecating var makes this less necessary), this (though arrow functions probably let this understanding be postponed a bit now), etc, but that's just basic requirements for doing your job... not so much the art or craft of it.

I can see a case being made for studying basic architecture patterns on the other hand...
My experience too. Couldn't help but be disappointed in the parsing engine of this game. But I guess I am a little spoilt, having grown up on most of the Infocom adventure games...
From my understanding, craftsman ship is not about algorithms at all, at least not the focus.
Can someone explain to me how can Samsung fuck up this bad after decades in the consumer electronics business and years as the market leader for smartphones?

Is it just plain old greed cutting a particular corner or is this a more complex science that I'm taking for granted?
This very case. From the first link of the article:

> According to the Playpen warrant, when a visitor logged in to the site with a username and password, the NIT would be secretly installed on the visitor’s personal computer. The NIT would then send the government identifying information about the user’s computer, most importantly the computer’s true IP address from inside the user’s machine.

The way this is worded, it could either be a sandbox exploit or just javascript taking advantage of eg defects in webrtc. But either way is local code execution.

I would be interested in any examples where this method wasn't used to track down TOR users. I know that lately there was some bomb threat at a university through TOR, and the university investigated the single user with outgoing TOR traffic at that time. But that feels like a rare exception.

I'm sure global passive adversary packet correlation attacks are being done by NSA et al, but domestic law enforcement isn't likely to see the proceeds of those. And if they were given a lead from them, the details would be parallel constructed anyway.
Do poachers have an incentive to kill tuskless elephants too, then, so they don't become more dominant than tusked ones?
> It would feel extremely awkward to now, years later, send them an email "would you know a job for me",

This practise seemed alien to me as well... but it turns out that it really is a common and accepted practise.
That would be me. I found Hugo and Jekyll because I wanted a simple but powerful way to build websites.

After using Drupal and Wordpress for years they're a total breath of fresh air.

I can put together a site in a fraction of the time it would normally take, host it for free, and through services like Snipcart, Typeform and Forestry.io, add some surprisingly sophisticated functionality.

For what they do, Hugo and Jekyll are excellent.
But the question is how do you reduce? How do you decide who to keep, when whittling down to ~100 from 4000 (or whatever the current number is)?

From my experience, this type of re-org leaves the resultant company unsustainably top-heavy. I recently left a company who downsized but refused to hire anyone "junior level" because their pivot "requires all stars". And we all know, when everyone is a senior, no one is...
A bit tangentially, this is also a great display of just how good readily available approximate solvers have gotten for a wide range of combinatorial optimization problems (like TSP).

The LKH solver used here has rather impressive performance. From http://webhotel4.ruc.dk/~keld/research/LKH/: "LKH has produced optimal solutions for all solved problems we have been able to obtain," and the studies linked there show that it really does find optimal solutions "with an impressively high frequency."

While the point here is to use an off-the-shelf solver, it can be nice to have visibility into what's actually happening:

- This is a reasonable example for explaining some of the local search TSP heuristics. For instance a "2-opt" move corresponds to picking a contiguous range of columns and flipping them.

- The previous HN post used simulated annealing, which would not be an outright terrible approach to TSP itself -- were it not for the better Lin-Kernighan-based approaches (like LKH).

- If we want, we can tell LKH to start from Sangaline's "nearest-neighbor" approach ("INITIAL_TOUR_ALGORITHM = NEAREST-NEIGHBOR"). This does not make a difference here though.
If you use docker to deploy, see cloudron.io. You can install custom apps and it takes care of encrypted backups to s3. And automates lets encrypt as well.
Why should I switch to this from Jekyll. There are dozens of site generators and when I go to their websites they all hash over the same set of features. Can anyone has used both or any other site generators please let me know what you found the differences to be?
I think all of this advice is spot on. It's what I've experienced myself working on Taskforce and Indie Hackers, and it's backed up by what I've learned from interviewing ~40 founders of profitable businesses in the past few months.

Picking a good market might be the biggest thing. If you pick a market you don't understand, it's way harder to build a good product that solves an important problem well. You end up guessing a lot. It's also way harder to get the word out, because you don't know your customers well enough to know where they hang out. If you go to https://IndieHackers.com, sort by revenue, and pick the companies making the least, the most common phrase is some variation of, "I haven't really done much marketing yet," and it's often because they're in a market they don't understand well.

I'm also a big believer in automation. I haven't done nearly enough of it, but I just got into using Buffer for Twitter, and it's a tremendous time saver (I can do all my tweeting for a week in a single 2 hour block of time). I have a ton of other marketing tasks that I could automate as well. Also, Mike Carson of park.io is making like $1.5M/yr as a solo founder/employee, and he claims it's mostly due to automation, so that's kind of hard to ignore :)
Many privacy and security concerns stem from the baseband processor -- from Stingrays to completely unknowable rootkits. The only real fix is to not use a proprietary baseband processor at all, though this would mean completely rethinking the mobile phone. (say, switching to long range WiFi)
^ this.

Github takes care of code and config.

AWS S3 takes care of uploaded static files.

But Tarsnap takes care of my database backups.

The only thing to be aware of is that restore times can be very slow.
Or put this program on the same VPS but instead of doing the gzipping and versioning yourself, incorporate Tarsnap[1] into the script. With Tarsnap you can also create a read/write-only key so that if someone hacks your server, a real threat mentioned downthread, they won't be able to delete your backups.

And whatever you do, check that you can actually recover from these backups every once in a while.

[1] https://www.tarsnap.com/
Is it modern because it's written in Go, or am I missing something?
This isn't true. The majority of contemporary philosophers do not believe in anything supernatural, but plenty of scientists still dismiss their work.

I say nothing supernatural, because the precise meaning of "naturalism" is contested in philosophy. For rather complex reasons, you can accept evolution, accept that modern physics is essentially accurate (only inaccurate so far as we're still discovering things and refining theory, etc), deny that there are immaterial souls or Cartesian dualism, yet not count as a naturalist. I am not sure if naturalism is necessarily a majority position.
There's an interesting comment about a similar thing happening with rattle snakes. It seems they evolve into silent snakes to better avoid human predators: http://www.abc15.com/news/region-phoenix-metro/central-phoen...
Because industry adopted an OS whose code was available for free, aka UNIX, and C came along.

Just today I read a paper fron the author of Concurrent Pascal to C.A.R. Hoare, written in the early 90's about industry's looming doom due to C's usage starting to take off outside UNIX.

He was right...
This. It's like you've read my code. Also worth considering encrypting backups so your users don't get screwed when your secondary VPS gets hacked.
There is a growing trend of static websites.

My favorite tool for static websites is Middleman (https://middlemanapp.com/), but competition is always good.
I think eventually the mobile data radio is going to migrate out of these mini-tablet interfaces we call phones, and into either a wrist-watch or pocket-watch form factor, with local wireless accessories fleshing out the rest of the UX.
Remember to have automated restore testing that validates restores are successful and the data "freshness" is within a reasonable period of time, such as last updated record in a database.

Lots of people only do a full test of their backup solution when first installing it. Without constant validation of the backup->restore pipeline, it is easy to get into a bad situation and not realize it until it is too late.
You can still exploit memory corruption, even if the app is sandboxed.
From Gunpowder to Teeth Whitener: The Science Behind Historic Uses of Urine
Argentinians? How did that make a dent :)
A version of this viewpoint is basically standard in modern particle physics, where quantum field theory is used to describe electrons and positrons as excitations of the electron field. (However, nothing in the QFT description treats electrons & positrons as vortex-like, so don't get too excited about the swirling..)
I think the author misused the word "software development craftsmanship". Or he/she is not talking about THE software development craftsmanship as http://manifesto.softwarecraftsmanship.org/
> Because we legislated like that for every accident, we're suffocated by regulations.

FTFY
HCAR 31 – Call for Contributions
Go back and re-read the original comment I replied to. You're just arguing for the sake of arguing by taking the words out of context.
Samsung says it's 'working diligently' as fifth replacement Note 7 burns
Ruby or Ruby on Rails, because they're the ones I'm more proficient in. I did very small projects in Node and Elixir and I would like to become better at Elixir. But the time for personal projects is small so productivity is super important.

In general pick the tools you're better at.
I would say get into government intelligence if you're in your natural born country; government contractor that deals with the military or police is good too.
No one woman reads HN ;)
Htc2u
Especially 9.:

> Do you use the best tools money can buy?

if you only use the best tools __money__ can buy, your development team is probably really bad.
We have multiple official languages, including an Italian derivative and French. Our history is as independently rich, tracing to the Holy Roman Empire, as that of the Germanic tribes.
You're right it doesn't. IAM roles are intended to be granted to the entire server, not a subset of the server's users. Any compromise of the server would be considered a compromise of its role. Yeah, this is a bit crazy depending on what you're running on it. I was running multi-tenant IIS hosts and the apps had no business with the metadata or ec2 IAM roles in my case.

If you want roles to work for other users via the meta data store you can intercept requests with a proxy and then grab the temp credentials STS assume role. This is how kube2iam works. Depending on your use case you'd have to write the proxy, automate the mappings and firewall rules, etc etc etc. PITA but probably doable.

On a different note, I agree with just about everything you had to say about the PITA that is IAM. Properly scoping permissions is much harder than it needs to be. Not all resources support tags, and even then almost nothing outside of ec2 supports tag conditions in IAM. This leads to many naming schemas and wildcard resource conditions :( AWS should have created the concept of resource groups. This would have greatly simplified giving users permissions to subsets of an accounts resources. I chalk this up to AWS's VERY poor collaboration between service teams. Nothing that came out seemed coordinated. This appears to be getting better (shrug).
Correction: They need to find a significantly better opportunity.

People don't change jobs for slightly better. It's too much risk and hassle.

Funfact: We're literally in a thread talking about how terrible are job interviews.
any recording?
Even with IRC you are still using someone else' infrastructure -- unless you run your own IRC network from scratch of course.
That's probably a result of Spacechem's history: The Codex of Alchemical Engineering, the game which would become Spacechem, and to an extent Spacechem itself, focus on programming things to move physical objects.

On a related note, thank you, Zach, for only having two mechanisms, using more visual programming, and adding a sync instruction. Until you play CAE, you cannot possibly know how good you've got it.
enter the NFL, MLB, NBA & Netflix + cheap flat screen televisions.
Duverger's law: single-choice voting tends toward a two-party system
So why isn't the American public demanding proportional representation in national elections? Especially in an election cycle as toxic as 2016?

https://en.wikipedia.org/wiki/Proportional_representation

Even in an election with all sincere voters (where strategic voting is magically prohibited), this law holds: https://www.rochester.edu/college/faculty/markfey/papers/Exi...
Collectively they do, but no individual poacher has much to gain from killing an individual tuskless elephant. It's like a tragedy of the commons, but one that works out well for the elephants.
Unless bug in their system, hack attack or human error deletes all droplets from your account. And yes, I have heard of stories like that from other hosting companies where a human error caused the account to be deleted and data removed.
This dual-system is one of the things that drives me crazy when in the UK. Oftentimes you get a sink with two separate taps, one hot one cold. So if you want to rinse your hands with warm water, you turn them both on and quickly move your hands between the two. If you're too slow, you get scalded!
I guess I don't get what you're saying. It seems like your argument is that exceptional people are hard to find so we should give up trying? What on earth is 10x code, or the 10x fantasy? I already gave you easy examples of people that are probably 100x more productive than average in terms of impact, so it's not like someone 10x better than average is a unicorn. I'm not trying to be rude, but "10x code not 10x developers" sounds like a delusional platitude you'd hear from a faux populist politician or something. It means practically nothing.
huh? If cell phones didn't exist, you would make an arrangement to go meet someone at a certain time and place, and if you both didn't show up, OH WELL. "stood up".

That doesn't diminish from the value and buy-in of cell phones and is a bizarre argument to make regarding the value, if any, of twitter.
I guess this could be used to reassemble images corrupted in other ways (other than shuffling).

I have a disk image of jpegs and other data I'd like recovered. It was Windows formatted a few different ways but any blocks that format didn't touch are still there.

There's other data there of course as well, so there would be lot of blocks that aren't part of images so would need to be ignored when reassembling the images.
Recommended change for additional peace of mind: The backup script does not have deletion privileges. A separate process expires old backups.
Well, I certainly disagree. Technically you are correct. In a vacuum any person, even my own mother, could endeavor to learn these things and do them.

But when you put a person's life in to context, how do you expect a working mother of three to just learn the tools? What if she has the remotest of computer literacy? That is, she could operate Facebook but no more? Then is it reasonable to expect her to learn how to administer her own server? Can she choose to spend hours a week learning for months while her children need food to be prepared for them, clothes to be washed, and beds to be made? In a practical, not theoretical sense, does she really have that choice?

The example with voting feels disingenuous because voting is specifically designed to be accessible to every person. Learning bash and administering your own web server is absolutely not the same.
regardless, it is a preferred method of communication (to the exclusion of other types) of many people, and is absolutely huge.
Yeah, I'm kind of wondering where that comes from... I guess because PET is a petroleum product? There's so much more to it than that though, it's silly to simplify things that far.
Even in this thread you can find many people besides myself attesting to the consistent power of referrals in most hiring. In fact, that's even one of the central

I am, frankly, amazed that you have never had a former colleague approach you about a job opening they had or express that they're looking for a new job. That's literally one of the most basic uses of networking out there, not to mention that many companies have explicit cash bonuses for referring new hires.

Here's a recent survey showing that most hiring comes through networking: https://www.linkedin.com/pulse/new-survey-reveals-85-all-job...
I hadn't heard of this. I just spent the last hour setting up my own federated server and playing with some clients. This is pretty great! A lot like Slack in terms of UX, but without the corporate walled garden.
Maybe Hugo has improved, but when I switched our static website from Jekyll over to Hugo, there was a lot to be wished for.

One of the problems is that it's not easy to integrate Hugo into any other build process. For better or worse, many website build tools right now are in JavaScript (npm, bower, gulp, grunt, yo, etc.). And on the flip side, Hugo does not do any static resource processing. So for our site, we needed to have Grunt tasks fetch third-party libraries, compile the JS and CSS, perform lint checks, and finally put files into the correct location so that Hugo could then be called to build the final site. Now, to be fair, Jekyll core does not do any of this for you either, but at least there are plugins in Jekyll [0], and integration of custom build scripts becomes a bit smoother.

This brings me to my second pain, which is shortcodes [1]. It is the closest Hugo has to plugins. Hugo completely disallows writing raw HTML in Markdown content (the cited reason is it "is in complete opposition to the intent of using a bare-bones format for our content and utilizing templates to apply styling for display"). It makes sense, and I'd use a system that separates raw content from more complicated code. But when you start needing to put dynamic content in your site, shortcodes in Hugo specifically are extremely unflexible. You're stuck using the Go template library that underlies Hugo, which gives you very limited information about the page being rendered.

Local variables, for example, are not scoped the way you think they are, and you are stuck with a "scratchpad" hack that Hugo put in [2]. To see this in action, here is code I had to write to make a shortcode for responsive images [3]. The entire process involved starting with a JSON file containing the shared configuration, having Grunt read this config to generate the images, and then using the code in [3] to also read from that file and find where the images would be. This is all without syntax highlighting or any useful debugging tools.

There are also just some times you really need HTML in your Markdown, and it doesn't make sense to use a shortcode. For example, a web page that contains very specific formatting that cannot be expressed in Markdown, but is also specific enough to that page to not be separated from the page's content.

All in all, we switched to Hugo for a reason: it had many features that Jekyll was missing at the time (although many it has since added). We wanted to express our website in a well-structured format that also allowed Markdown so not-especially-tech-savvy people could edit content. In the end, we got it working (here's the site, a good example of how a Hugo site can come out pretty great IMO [4]), but it caused a whole lot of pain and misery for me.

[0] https://jekyllrb.com/docs/plugins/
[1] https://gohugo.io/extras/shortcodes/
[2] https://discuss.gohugo.io/t/counter-variables-and-template-s...
[3] http://pastebin.com/ZjiWpDHc
[4] https://www.castlepointanime.com/
>That's a pretty pathetic standard for "good"

The standards are set by reality, not wishes.
I asked my law school friends what their internship interviews were like and they aren't asked any technical questions about law. They just walk through your resume and ask you behavioral-type questions.
The ircv3 server-time extension can be used to implement scrollback intelligently, there's a ZNC plugin which does this.
Part of this comes from long-standing partnerships between telecoms and intelligence agencies. Esp MI6. Ever wonder why there were protocol steps like answering without ringing ir notifying user available in user phones? Sure it was just for data collection systems in industry that happen to hack a solution out of a GSM phone. ;)

Unfortunately, many schemes were baked into the standards you certify against. Good luck changing that while reaching mass market.
I wholeheartedly agree.

I read a book last year I think you would enjoy. The Culture of Make Believe by Derek Jensen. If you've got time I highly recommend it.
Try Inform games. They're built atop the Z-machine (and now its successor, Glulx), and have a very good parser. This is why when I make an adventure game, I'll give you a verb list unless there's a explicit reason not to. Even the best parser can't compare to the ability to express your intent in the knowledge that it will be understood.
My wife reads it quite a bit. She isn't a tech, but she likes seeing what we all say about stories so we can talk about it later
My pool for drawing personal conclusions about hiring is not deep, but in my limited experience (both in hiring and being hired) there are two things that seem to matter above all others:

1) How personably the candidate is. Do you want to work with this person? Does he/she have basic social skills?

2) Do they have a coding-related passion project? It almost doesn't matter what it is, as long as they have one.
On a long enough timeline, the survival rate for everyone turns to zero.
How Michael Abrash sees the future of virtual reality