skysight-inc/HackerNews huggingface dataset:
That's like saying "corruption will always exist, investigative journalism is crude and ineffective - instead educate people to spot corruption and live with better morals".

There's nothing ineffective about uncovering a problem and using transparency to create an incentive to fix it. Crude, yes, but not ineffective at all.

What GL did might be considered complicit in skimming users, especially if they acted under pressure from fraudulent shops or even the skimmers themselves (how do we know?).
Let someone selfhost who can just update the hardware firewall rules every few minutes to mitigate the DDoS?
Russian Data Hidden on Norse Attack Map. Why?
A Study of Tor Users and Wikipedians
Does anyone know why the list has been censored ? Does it violate any law ?
I've worked with similar organizations that want the transaction on their site due to all the reasons mentioned in the comments.

There are providers that use JavaScript to allow you to take payment information on your platform but never let the sensitive details hit your server. I believe this removes your platform as an attack vector for leaking credentials. The only locations that have traces of that information are the browser and the payment provider.
Solution is dominant assurance contracts, see https://en.wikipedia.org/wiki/Assurance_contract#Dominant_as...
If you re-read your comment, does the 'pre-release' and 'post-release' thing not ring a bell? Also, it seems that the only real ID on what software you have seems to be the build number, and not even that makes sense.
Ask HN: What's the best 'non-frustrating' search/directory UI/UX you've seen?
I'm trying to find some inspiration for a new search engine I'm working but have found most searchable directory ui's to be very frustrating to use.

I'd love to know what you guys have seen out there. What have been some of the best examples of this type of ui that you've seen?
> groovy, and they have fairly stable and usable static compile target release

Citing some Groovy 2.x Release Notes to prove a claim of "stability" for Groovy is like quoting an advertisement for Parmolux washing powder to prove its "effectiveness" at washing out dirt.

Not many developers bother with Groovy's static compilation annotations. It's used mainly as a scripting language for testing Java classes, gluing together Java programs, as a build DSL in Gradle, and scripting in Grails. When static annotations are used, their use is typically small-scale.
Certainly possible, but mostly only very, very, very rich people would live there. Have a look at "Elysium". The rich people would create their own culture. They wouldn't take care about the Earth.
For example, creating a file in one app, editing it in another app, sending it to a third app to upload somewhere else.

That's hard to do without a filesystem or proper Intents.

iOS has neither, so people use Dropbox as filesystem.
Not that I know of. My guess is that somebody on that list threw a DMCA takedown notice at Github/Gitlab to get it pulled. Knee jerk reaction is to pull first, verify later.
I'm curious, what do you do at work and what kinds of algorithms do you bump into?
:)

https://youtu.be/5YBwDNfOaxU?t=16s
According to https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...:

> It criminalizes production and dissemination of technology, devices, or services intended to circumvent measures (commonly known as digital rights management or DRM) that control access to copyrighted works. It also criminalizes the act of circumventing an access control, whether or not there is actual infringement of copyright itself.

So no the DMCA is not just about copyright.
I don't believe it is your place to do so. You have the right to, but you have no real reason to. You will suffer no consequences from removing that list.

Responsible disclosure works because companies are responsive to disclosure.

Full disclosure works because companies are negligent and they've been outed.

The author did contact said websites, it is their responsibility to fix the issue in a timely manner. Removing the content was akin to a newspaper removing stories relating to certain politicians to protect them. It is censorship.
NBC News?
My bad. http://www.huffingtonpost.com/entry/scientists-take-on-great...

The NyPost copied it from Outbreak, which was a 'wildy irresponsible' article meant to highlight the urgency of the situation, it's apparently dying not dead.
Is that supposed to be insightful? The first part is obvious, the second part is nonsense. Neither offers a secret to repeatable, predictable software development. If you're going to make a fantastic claim that you can make software engineering time estimations reliable you should back that up with how you do that. Saying "I've been doing it for a long time and I call it engineering." Is not enough.
Have been using KiCad for PCB development for my hardware startup and overall happy with the choice.

Yes, they have made questionable UX decisions in development but then I've not tried an EDA tool that got the UX right. For those considering KiCad, but struggling to do it by themselves, I suggest you either take a Udemy course to show you the user flow. Or better yet, buy some tuition (with beer or whatnot) from someone at the local hackspace or similar.
Interesting use of the lyrics to Randy Newman's classic "Louisiana 1927"

https://youtu.be/MGs2iLoDUYE

If you only know about him as the guy who does Disney/Pixar music you're really missing out.
Perception Is Reality for Donald Trump
Wow, thanks for linking to the site. It seems like an amazing resource!
I'd never bash CLRS but people suggest in strange situations. It's definitely not a good introduction to algorithms. It does makes sense as a reference and of course as a course textbook. As a book to actually read, Kleinberg/Tardos is much better.
> guys is a gender-neutral term these days

"guys" sounds like "gaius"!
How would that work in practice in this case? Note that the contract would most likely be with an individual developer, not the project itself.
Now I see. I thought this was a list of stores hacked through the current vulnerability. This is a list of stores hacked through 1-2y old vulnerabilities.
Are you serious?
Do they handle these kinds of things?

In any case the only operate in USA.
Unfortunately, even if your payment service is hosting the system that processes the sensitive details, there's always an element of vulnerability on the merchant's side if they are hosting the rest of the site, simply because a compromise could redirect customers to a hostile alternative site to collect those sensitive details. At that point, they're really no better off than a completely fake site that never had any real relationship with a payment service at all. Merchants should always be serving their own pages securely for this among other reasons, even if they are never intending to receive sensitive payment credentials.
The pf has been ported and it shipped already in Solaris 11.3. It is based on OpenBSD 5.5 code.
I assumed it did, but perhaps it doesn't.
Po-tay-to po-tah-to.
Как вывести деньги из Crp center Получаю $20 в
Can someone summarise the paper? Seems to complex for a lay-man. For example, what is Lattice QCD?
Not sure who this guy is but he seems to have completely missed the point about what Fiske was saying. Sure the internet has heralded a new paradigm but that doesn't mean that we have to just accept the negatives. And the negatives with the internet are just as severe as the positives.

Go spend time on any politics forum for example and it is downright scary. Conspiracies run rampant and are unchecked, experts are personally vilified and viciously attacked and facts come second to feelings and opinions. And all evidence to date suggests that this is not helping society but actually making it more polarised and less cohesive.

And exactly the same thing has happened in other fields e.g. climate change. Legitimate criticism is always useful and welcomed but it needs to be constructive.
My work is primarily Python, and only a few months ago I started learning Go. Both of them have their own weak and strong points, and I can't definitively say you should go for one over the other, but these may help you consider:

- If you want to get sh!t done, and quickly, go for Python. It's really easy to build things from scratch with Python because of how concise, clean, and clear the language is. Plus, the Python community is huge so there's practically a package for any advanced functionality you need (and it's easy to write one yourself). There's a reason why research giants such as Google, NASA, and the LIGO project use Python -- it's because you get to spend less time getting your code to work and more time actually designing the underlying models. TL;DR: Write and ship code faster, at the cost of actual runtime performance (but PyPy and Python 3.x with asyncio, makes Python more competitive in performance as well).

- If performance is your focus, go for Go. It's a lot stricter than Python because it's a compiled language and therefore you'll get a lot more compile-time errors with regards to variable typing and conventions (reminiscent to, but arguably even stricter than, C++ and Java). On the upside, you'll undoubtedly incur less technical debt, at the cost of spending a lot of time cleaning your code and getting it to work. Go is pretty young, but it's gaining a lot of traction (spawning the likes of Hugo, Docker, and Kubernetes), so if you need your program to be more performant and highly concurrent, go for Go. TL;DR: Spend more time writing code, in exchange for your program being easily concurrent and performant.

Personally, unless I'm writing OS-level programs that require fine-tuning of things such as memory management, I'd go for Python. Some of Go practices and conventions got tedious and old pretty fast.
10 Reasons Dairy Farming Is the Best Job in the World
That may have been the case with GitHub. Gitlab claimed that it fell into the same category as zero-day exploits (which is ridiculous), and that as such posting it wasn't responsible disclosure and it thus violated their ToS.
> When the authors protest that none of the errors really matter, it makes you realize that, in these projects, the data hardly matter at all.
Brutal. What a fantastic read, thanks.
After graduating in CS with honors, I intentionally enrolled into two best nation-wide universities and cherry picked the most difficult theoretical courses in order to get a math boost - now it seems to be paying off with the possibilities still open in front of me, capability to learn even bleeding edge concepts whereas observing most of my friends getting stuck in old things that are rapidly being phased out. It seems like you need to study hard every single day in our business; I guess the same is coming to all of them soon.
Please post it to pastebin.com or something like that! put up a torrent I want to know which sites so i can steer clear of them.
This would not be exploitable if ASLR was enabled.
Post it to Pastebin.com or make a torrent!
They released some of it under a look-but-don't-touch license for a while, in an attempt to build a community, and you could get a free license for the desktop version of QNX (with all the developer tools in it). I think I still have a CD somewhere. It worked pretty well.

It may even be still available, but after digging up my old Foundry27 username and password (which, surprisingly, still works), their download site is an impossible trainwreck and I was unable to find it any more.

The demo floppy, by the way, is here:

http://toastytech.com/guis/qnxdemo.html

Requires a 386 and 8MB of RAM.
You seem not new here (>3000 days). Is it really the first time you see that the duplicate detection algorithm don't work reliably on HN ?

This bug is not even really a problem: it allows to give a second chance to unlucky good submissions.
Don't forget Windows 10 NSA Edition. Auto updates you can't disable, constant resetting of privacy settings, insane new levels of telemetry...

The scary thing about auto updates is you can never be sure what is being installed on your device.

I'd be shocked if there wasn't some chilling effect from this already.
Intent to Ship: Web Bluetooth in Google Chrome
The entire card payment system is fundamentally undermined from a security point of view, simply because it relies on merchants pulling funds instead of customers pushing them.

We would probably be much better off if we'd evolved a system where the payment authorisation step was always hosted by the customer's bank, and everyone expected that instead of putting card details or the like into some merchant's site, they would only ever deal with their own bank.

In the absence of such a system, modern 2FA schemes are trying to plug the gap, but they almost always introduce more friction in the process and consequently affect conversion rates. When not everyone is using them, that makes adopting 2FA potentially a worse option commercially than accepting the losses due to a certain level of fraud in return for better conversion rates across the board.
Integration is definitely an area where open source could do better, the freedesktop project is a step in the right direction, but we need more.
> And yet you're a core contributor, are you not?

A contributor to the core, certainly. I can't say if I'm a “core” contributor.

> Well... what are your suggestions? What would you do?

I can't say with certainty what I will do, but I can point to what I've done. I've tried to fix some things which have bugged me.

> What's the future of the language?

I have no idea. There's not really a roadmap.

> Should people bail or not?

If they want to. If they'd rather use something other than PHP, and they have the choice to, then they're free to do so.
I don't think one should mix validation and safety as such since it risks becoming non-obvious. When the validation criteria changes six month later someone might rewrite the validation without considering that it's also a safety feature. By making the proper way to use it restrictive one might end up bypassing the validation and using the unsafe part by re-implementation if not directly. It could also be that the error isn't malicious, but that the hash for some reason ends up being faulty.
The secret life of a startup employee
Top Ten Celebs Nude Pics Instagram
I read most of both of TAOCP and CLRS when I was in my late teens and early twenties. I couldn't follow the most difficult mathematical bits, but I don't think it's THAT unusual to have worked through most of both of them.
What myth? PHP has inconsistency throughout. It's one of the most commonly cited complaints about the standard library, for example, which lacks a consistent naming scheme, consistent parameter order, consistent error-handling behaviour, and so on.
It depends.

FB auth might not be appropriate for B2B and github login wouldn't be appropriate for a non-dev user base.

My guess is that you need to think about your users. Who are they? Why are they using your app? Your goal here is to reduce friction and you can only do that by offering options specifically selected for your users.

As an actionable, go find someone who you expect would find your app useful, ask them. Find your competitors and see what they're doing - even better if you find something missing.
I think my personal favorite is the Kahneman quote about how you have NO CHOICE BUT TO ACCEPT.
Global treaty to reduce HFC refrigerants signed
Yes, that seems to be it. Hopefully the Project Zero people will write a blog about.
I'm pretty sure it's the
hardest language to implement

Harder than languages that require JIT compilers to achieve reasonable performance?

Even scalac and ghc are pretty complex beasts in order to Scala and Haskell reasonably speedy.
> withdrawals are very very similar to heroin/morphine withdrawals

Source please.

Anecdotal evidence from those that have gone through both heroin and kratom withdrawals generally say coming off kratom is extremely easy by comparison.

It's also worth noting that, anecdotally (and I include myself here), for many people coming off kratom is easier than stopping drinking coffee.
From benchmarks such as http://www.techempower.com/benchmarks/#section=data-r11&hw=p... ?

Compare Symfony2 with Spring, for example (~500 vs. ~22'000 responses per second).

Or if you want to only use the raw language itself, php-raw with ulib-postgres (~90'000 vs. ~300'000 responses per second)

And with PHP, the larger the codebase, the slower it always responds, because even with opcaches loading it into RAM is a major bottleneck.

That’s exactly the issue at hand here.

And compare actual performance, for example JSON serialization, that’s not even fair anymore, symfony2 reaches around ~2'000 a second, gemini, the fastest fullstack framework, reaches ~970'000 a second.

Raw PHP reaches still ~170'000, but the fastest non-PHP raw language is still at ~2'200'000 compared to that.

These are actual performance issues that will cost you actual money. Even saving 20% of hardware and server costs can be the difference between your company being cost-effective and dead.
I've got a real good advise for you. Get yourself a good IDE with a code-completion feature. Trust me, the very next day you'll forget your grief :)
As a low tech experiment, I just grabbed the list that started this thread and tried a few random sites.

I only made it to the third one before I found an http:// checkout page. I tried to change the address to https:// and found it complaining about a cert mismatch. I also viewed source and confirmed the form submits to an http:// address.

So.... yes.
Pony VUG #7: Nick Pruhs: Designing an Actor Model Game Architecture with Pony
On mobile now, so can't give examples, but do a search on Google scholar and you really will find plenty evidence there
Ask HN: Anyone have a good map of web technologies?
I used to have a really useful tree of commonly-used web development tools/technologies. Included everything from databases to front-end frameworks to hosting services.

Anyone have something like this, relevant in 2016?
Tesseract.js is a pure JavaScript port of the popular Tesseract OCR engine
Explaining Support Vector Machines: A Color Based Nomogram
Vanadium – Create distributed applications that can run anywhere
I've actually managed to draw myself away from the point I was making, which is not about the relative structures of professions.

It's that professionals perform similar tasks very often. Including us.
I don't know about my position not being left. I mean, I am pretty left. I think the difference is, I'm not insane, so you don't hear my position on the nightly news. There are as many crazy leftists are there are crazy rightists: the trick is to avoid both.
Who says efficiency was not a concern when developing the universe? Otherwise the creators would not have included limitations like finite light speed or Heisenberg indeterminacy principle to reduce computation time. :-)
> And all industries also estimate how long planning will take but it's a vastly more significant for software as that's the entire thing.

Which means that we're doing it more often, so we have more data and experience to call on when estimating.

And it means it's more important to estimate the design task, since it's vastly more significant.
In these matters it pays to look closely at wants and needs. A lot of restaurants want great pastry chefs but in how many restaurants will an excellent pastry chef really make a difference? The whole experience of a night out depends a lot more on the desert. Sure an excellent desert can make the difference between a good meal and a totally over the top experience worth twice as much. But how many restaurants are on that level? Most suffer from significant weaknesses in the basics. A dollar can be spent only once and spending salary on pastry chef competes with cleaning the bathrooms more often.
I do like computerphile, but as a professional developer, vastly too simplified for me. I do send it to none technical friends, as it cuts out the unnecessary details to get the point across in a ELI5 way.
Don't do unaligned memory access, whatever your cpu flags say.

Another thing you can do, if you don't plan on using the results immediately, is to use non-temporal store (movntps for SSE2). If you do plan to use the results right away, then just use them without storing in main memory.

And you can do the usual unrolling of loop.
Learning isn't about your current salary. It's to qualify you for your next salary.
my little local bank (coast hills fcu) isn't the greatest and the online banking sucks big time...i'm looking for a fairly solid new bank that treats you decent and has good-great online banking.
The GoF design patterns book has two core, very closely related, problems.

The first is that it doesn't make enough of an effort to present "design patterns" as a conceptual framework. Can you program without using design patterns? No, you cannot. You are always using design patterns whether you know it or not, you're just using ad hoc design patterns without realizing it when you don't think you're using patterns. The book's failure to elucidate commonly used ad hoc patterns as well as common anti-patterns is one of its principle shortcomings. This is something that the refactoring book did much better, by providing examples of how things can be engineered in different ways and why one way might be desirable over another (and how to transition between them). Instead the GoF book largely presents a canonical list of some design patterns, giving people the false impression that these are special and unique versus merely a sampling of ways one might do things.

Additionally, the GoF book doesn't make it clear that each design pattern exists to work around specific constraints, and thus doesn't educate the reader when and why the design pattern should be used, and when not. The GoF list of design patterns is very much tightly coupled to the peculiarities of Java at the time the book was written. Many of the design patterns aren't necessary outside of that environment. For that reason, a lot of the design patterns in the book are either obsolete or so seamlessly built in to popular languages that it's not necessary to implement them as described in the book. Many of the more advanced "behavioral" patterns from the book are essentially ways to work around the fact that Java didn't have first class function, when that changes the design patterns that you end up with become very different.

A lot of the GoF's list of design patterns just aren't that useful anymore in modern languages, even though many of them are as applicable as ever (modern languages bake iterator support into the language, for example).

Additionally, the GoF design patterns break down into two categories: everyday patterns (like iterator, factory, proxy, or adapter) and sometimes patterns (like flyweight). This means that most of the patterns shouldn't be used in every project. Because the design patterns in the original book are somewhat out of date and because there's been so much cargo culting around the GoF patterns there's grown a substantial backlash against patterns. So people tend not to describe new patterns in such a way, even though they should. The concept itself is quite sound, but it requires diligent effort to ensure you're applying it well.
I do PCB design, mostly in Altium, and I'll even add that some of my designs are of relatively high complexity.

Saying that Kicad interface is horrendous compared with Eagle is, to say the least, disingenuous. Eagle has a terrible interface, lots of limitations, and a very strange mental model for design.

Kicad is still far from perfection, and I do believe that the UX must improve. But even the best tool in this aspect - IMO, Altium - suffers from a lot of other issues.
Well, I answered the rest of the questions perfectly and exactly like he expected, so it might have helped.