skysight-inc/HackerNews huggingface dataset:
What's preventing me? My preference for a different kind of separation between data and presentation. No one right or wrong here, just a matter of taste :)
I've over-engineered plenty of software in my time. Most of the time, it was because of boredom with yet another crud app.

An anecdote about rewriting:

I've also been involved in 4 successful rewrites. The decision to scrap/start over is rarely a good one. In my case, my team had inherited a bizarre suite of apps that combined VB6/C++. It was full of memory leaks, and had never been successfully deployed in the 3-4 years of its existence. We rewrote the entire suite in a year using .NET (1.x at the time). We (developers) went onsite to a bunch of our clients and watched them work, figured out what the system really needed to do, and made it do exactly that. The result was the first successful deployment the company had had in 4 years. It also sold itself in sales meetings, because it had been designed by watching users, rather than by guesswork.

So rewrites can be done. The question is: how bad is the underlying system? And how much easier is the problem to solve in technology X vs Y?

In our case, the underlying system was atrocious, undocumented, untested, written by a COBOL programmer who did not understand VB or C++ or OOP. And the .NET WinForms stack was vastly more productive than the C++ (and even the VB6) stacks we were replacing. The decision to rewrite was pretty easy.
That explains very little of the most common form of trolling, in which the target of the abuse is every bit as obscure as the abuser.
I believe this behavior has been dubbed "Resume Driven Development". I am sure I was guilty of it when I was a junior developer. It extends from over-engineering to also selecting the hot new technologies rather than the tried and true ones. It's actually a pretty rational behavior from a self-interest standpoint. As a manager you have to balance the needs of the projects with the needs of your staff to develop their skill sets. If you don't, they will languish and the good ones will leave. For instance, I will try to work with only 1 new technology at a time in a project, try to limit the super abstractions and over-generalization to libraries, where you might get real benefit from them someday, rather than the applications that come and go.
Move Over, Lasers: Scientists Can Now Create Holograms from Neutrons, Too
If you make the browser window narrow enough the background images are disabled and it becomes readable.
i'm not an AWS customer, but from what I have heard, you would be financially responsible for the DDoS traffic bill.

Amazon might wave the fee, but you are the first party responsible.
Key word is "directly". Of course everything is about the language, eventually. But that doesn't mean that the solution for something exists inside the language. Learning curve can be addressed with docs and diagnostics, for example. Not everything needs to be (or can be, because stability) addressed by the language.
At a 0.05% expense ratio, you need to hold $250k for 40 years to pay $5000, not to mention the extra fees if you want to rebalance as the market changes. It doesn't seem to make sense for lower-end investors, which are many of us.
Lithuanian there. I think we inherited a very similar system from soviet times.

Various things are slowly decoupled off the address registry. Major thing left is voting in election. Someone is eligible to vote for municipality. As in, for mayor of that municipality or it's parliament member. There're also optional municipality services that run off the same registry. For example, your kids may be rejected from municipality-sponsored kindergarten if you're not registered in the same municipality. This is to ensure another municipality is not receiving your taxes while you leech off neighbouring one. I guess that will get centralised sooner or later.
Keep your friends close, and your enemies closer.

The idea of constantly surrounding myself with enemies sounds nightmarish, but I can understand why it works.
I haven't read the whole article yet, but gzip and bzip2 recover fairly well from errors. As they are divided into blocks, flipping a bit will make you lose, at most, one block. This is not related to error correction though, but a way of mitigating losses.

>> Just one bit flip in the msb of any byte causes the remaining records to be read incorrectly. It also causes the size of the index to be calculated incorrectly, losing the position of the CRC32 and the stream footer.

This sounds severe enough to me.
That's not how business works. If you wrecklessly drove a company into the ground, you're going to have a hard time finding another leadership position at another company.
Send + Sync are automatically implemented for a type X if all of X's constituents are also Send + Sync. In practice, this means that unless you're using unsafe code, Cell/RefCell or Rc, then the Right Thing will just happen automatically. If you are using Cell/RefCell/Rc/unsafe, then you need to think carefully about your synchronization story anyway, so it's typically not something you just forget to do.

For more details, see: https://doc.rust-lang.org/std/marker/trait.Sync.html and https://doc.rust-lang.org/std/marker/trait.Send.html
Would it be illegal to innoculate IoT devices by forking Mirai and then changing each vulnerable device's default password to a random choice of high entropy?
Is there any actionable advice here for a Windows user? I mean let's say one is using 7zip which defaults to .7z format. Does that correspond to any of the formats discussed in the article? Would it be better to use a different format or a different program?
How does TAR mitigate the issues mentioned in the paper? Sincerely curious, my knowledge is limited. AFAICS, XZ can still "corrupt" the TAR stream and you'll need quite a bit of extra error correction to recover from that.
"people over-engineer because they're so afraid of making a bad decision that they try not to make any decision at all."

This goes for refactoring and TDD too.
but that won't happen because companies will still have to disclose financials, and companies with poor fundamentals will be shorted by arbitragers. The pricing mechanism can never go away completely
The same way it survived when it has insane crime rates. But nobody is advocating bringing back crime, are they?
And what do you recommend for your mathematically inclined friends? Any books you recommend for asset allocation and rebalancing principles?
C2C – False Sharing Detection Using Linux Perf
I think this is missing one component though. I agree I wouldn't, you wouldn't, in fact most people wouldn't debug their refrigerator over a dollar a month bandwidth bill.

I would however take into consideration bandwidth bill effects of what I buy. By comparison: today I buy LED lightbulbs and energy efficient appliances because they will have a long term cost impact on my electricity bill.
Google DNS doesn't store any identifiable/private data, as far as I understand?

https://developers.google.com/speed/public-dns/privacy
They Took in One Refugee Family. But Families Don’t Have Borders
If you can get access as riot then changing the password should be possible - assuming (and I haven't looked at the source yet) that the hacker doesn't when they first get control (although if the source is original it would have a/some passwords in it as you can't control something if you don't know the password).
Modifying the existing code to find and remove the added components (as you know what's been added by the code, where it's been added to) before resetting the password ought to be doable.
Changing the password ought to then alert the users that something's wrong ("hey, my internet connected [thing] isn't working?") so hopefully they will then contact the vendor, or bitch about the product on a review site, which will make the vendor sit up and notice if a lot of people do this. If it looks like this hits a company's bottom line it will have more impact.
You may have to hit the machines more than once because support will probably start with 'flash the firmware' which will reset the password, so a couple of passes to ensure the users get fed up, and support suggest changing defaults might solve the problem.
A more serious/damaging and potentially dangerous (depending what the IoT thing is being used for - ie fire detection, child monitoring) would potentially be - and this is not my field - to deploy null/corrupt/fake firmware to these devices to take them offline until a firmware flash is carried out. That would require different tactics than just modifying the source, and would be more complicated due to the different types of device. I'm not sure how easy it is to remote flash this stuff, whether you need certificates, whether you can flash entirely non-functioning code and how easily. As I say, not my area.
Anyone know if it's possible to put this code on a DNS box and when an attack starts go to each source ip, attempt Telnet with default list, then clean/change password/reboot/re-firmware (whichever - any/all) to kill the sources our do these systems use ip masking/obfuscation?
Thank you, I found the numbers difficult to follow, too.
The tech developed by https://shorthand.com/ has a small credit at the foot of this story.

This kind of journalistic work makes worthwhile all the labors of internet people. Browsers, Javascript, routers, servers, security, even JPEG, come together here to retell the story of that disaster, along with good writing and photography. Let's hope the right people see this history and learn from it
Atlanta 1GB/s 69$

No TV, just net + router included
Second Beta for Krita 3.1 will officially support OS X
Kitto – A framework for interactive dashboards in Elixir/React
Yea I started thinking about it after I posted. Ya know, the heat and stuff.
It was nice on my phone
You cut that sentence short...

"How do you distinguish between pure luck, actual skills, and illegal manipulation?"
How We Survived the Dyn DNS Outage
this company is like citadel, which is that their main business is market making and non-directional trades. They dont pick directional investments, as most investors do. rather they are in the middle picking up pennies, except many billions of them. But these returns may be exaggerated or there is information missing...20% a year far exceeds the rate capital is being created by the global economy. At that rate, it would eventually own the world and all markets. I think their actual returns, assuming the fund still trades (its operations are very opaque) are much less...maybe 5-6% year. The bigger a fund gets, the more impact its trades have on markets, which limits its size
Yes, but not with vuex (model.sync is not an option)
Well, you've always got insiders in the sense that most people know their own industry better than they know other industries. Passive funds are great when you want to diversify or lack knowledge.

But for example I've got a ton of money in cryptocurrency right now, it's my field and I've got way better-than-average knowledge about some of the coins. This helps me make informed investments, and I've been able to beat the passive rate by doing high risk investing into assets that were obviously priced incorrectly.

I'm not a day trader. I'm like the guy who goes about his way normally, but isn't afraid to pick up $20 off the ground when I see it. I spend some time looking for it, but it's not where I put most of my energy.
You would need to be away for at least 30 days and your prospective tenant would need to sign a lease for at least 30 days. Then, under this legislation, it's kosher, and would be governed by your own tenancy agreement/coop board/whatever.
Yes but the ownership is open to anyone, so it's a lot easier for activist investors to change the mission to a more profitable one. Musk is keeping SpaceX private specifically to keep this from happening.
Doesn't this brick the device from the user's perspective?
It's funny you say that because the author addresses this at the start of the talk. He says that when it was suggested to him by a friend that he write a book about the Collapse, he agreed only on the condition that he could distinguish himself from previous publications on the same topic precisely by talking more about what the Late Bronze Age was actually like, and what was lost.

He also says if he had to choose any period of history to live in he would choose that period.

I don't think he should be blamed for writing what he wants to write about, but maybe the marketing of the book is a bit misleading.
The current sync recommendation is emerge-webrsync:

# emerge-webrsync
Fetching most recent snapshot ...
Trying to retrieve 20161021 snapshot from http://mirror.com/gentoo ...
Fetching file portage-20161021.tar.xz.md5sum ...
Fetching file portage-20161021.tar.xz.gpgsig ...
Fetching file portage-20161021.tar.xz ...

GPG is enough cryptographic assurance for me.

(Edit: WTF! Either past-midnight has zapped my brain, or this is a total community pants down moment. emerge-webrsync doesn't actually verify the GPG signature by default, despite downloading it, and no warning is issued! One must follow the obtuse, well-buried instructions @ https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/Features... to get it to actually verify ... I've added another bug @ https://bugs.gentoo.org/show_bug.cgi?id=597800 about this... serious misfeature! Looks like for all intents and purposes if you want to own the average Gentoo box, having MITM on sync + emerge is enough! NSA must have been using that...)
That was my point. How do you know the pub key is not tampered with? Come to think of it, is meeting in person the only reliable way to reliably exchange keys?
OP did not mean "tightly coupled" in the traditional OO sense. They meant that they prefer their presentation to be coupled with their logic, which is how React components work.
OP means xz all individual files, then tar them without compression.
> You need to think in terms of components.
reply

Why do you think I need to think in terms of components? I'd say you need to see a bigger picture not limiting yourself by only components approach. Components/modules is an essential thing of any complex project in general, ie not specifically related to the web development, but that's not enough. Try to realize that for example using praised by hipsters mixins for inheritance makes it very complicated to track down from where things came into the final object.
Indeed, and by pushing the production of goods far away from the people who consume them, modern industrial capitalism makes it easier for the consumer to ignore things like this when they do happen. After all, they're happening to foreign people far away, not to people next door, people Like Us™.

You can see that logic in action in this infamous 2013 essay by neoliberal pundit Matt Yglesias, arguing that "Different Places Have Different Safety Rules and That's OK": http://www.slate.com/blogs/moneybox/2013/04/24/international...
Sounds like a recipe for madness, suicide, and homicide to me, especially given the lack of escape.
Show HN: ARMv7 emulator written in Rust
These Android-addicted ex-Googlers just made a 4K set-top box that’s only $99
My guess is that he was being hyperbolic. But even if he weren't, you can still get something that has the same expected return over time as picking individual stocks at random for a much lower up-front price by choosing a total stock market ETF. Remember that he was writing that comment at a time when the latter option didn't exist.
Sony?
Speaking of the long term.

The thing is the flavor of over-engineering JavaScript suffers from - bringing in frameworks/tech the project can be done without is bound to backfire at some point when (and in a ridiculously fast moving ecosystem like js we're talking 1-2 years) you can't find engineers with the skillet needed for the the "old tech"-based projects.
The reason this attack became known as the swift hack is because the hackers were able to send messages over the swift network to transfer money around, however this how the system is supposed to operate, it's what the swift network does.

What was hacked was the bank where the messages were sent from.

https://www.bloomberg.com/news/articles/2016-05-26/swift-hac...

If you read the article (any of the articles) the headlines always talk about the 'swift hack' however it was the _banks_ that were hacked (and the article says so), not swift.
There is also another form of trolling, common on the internet: the person is bored and looking for entertainment.

Or my favorite form of trolling where I merely use the thing I am commenting on as a sort of plot device, a writing and thought prompt even, that helps me think through a thing. Like right now. This comment is more for me than it is for anyone else, it lightly disagrees with the OP, perhaps even trolls, but it's not for OP, it's for me.

The upvotes and downvotes then help tune me to the community and/or society. Yes, I troll like this IRL as well. Just say something outrageous, see what happens. The resulting debates are often great fun and tell you a lot about the people around you.
Yeah especially when Sumner Redstone dies. Then all bets are off.
LtU discussion:

http://lambda-the-ultimate.org/node/5366
700 bottles containing ancient antidepressants, heart medication found Istanbul
This is good advice. Despite the financial crisis of 2008, the S&P 500 is still up 80% since 2005 after dividends
I dunno. I agree that readability is important, but I love the impact that creative design can have on the reader too. The pictures in this story, and creative design decisions like draping the whole thing in shades of black (echoing the blackness of coal and the polluted industrial sky) highlight the story's horror.

There's room for both approaches; print magazines have long ranged from those with utilitarian layouts to those with lavish, creative layouts, after all. So there's no reason to assume the Web can't be the same.
I don't follow this objection even a little bit, but I'm also not very motivated to try, so: no need to clarify. I'm just going to reiterate.

I am making a very simple point. If you don't trust NIST standards because you think they're backdoored, but won't run Russian standards because you think they might be too, the answer isn't to compose the two flawed standards.

Instead: just use a crypto stack composed of well-reviewed, well-regarded components that are neither NIST nor GOST standards.

Nobody in the world thinks Curve25519 is backdoored, or that Chapoly is, or that Blake2 is.

In fact: this is what I think you should do anyways. Maybe, just maybe, you should keep using AES because it will be more performant --- but the cycles/byte cost of bulk encryption is so low that I'm skeptical that this matters. Otherwise: avoid crypto standards like NIST and GOST. Standards processes produce crypto that is at best ungainly and at worst actively harmful. Standards are evil.

I am, of course, addressing this advice to the very, very limited subset of engineers who should be working with crypto directly. Everyone else should just use Nacl.
You say this as if it is just one device used in these attacks. And as if it will be easy to stroll over to the owner's location and determine the supply chain of that one device. And as if it will be easy to collect from the Chinese manufacturer who probably folded last week and reopened under a different name for completely different reasons.
And yet I can't read it on my phone without scrolling side to side.
Couple things here.

Firstly, as the MM daemon runs on its own process and is well-separated from other code, it is far easier to audit, debug and so on. Its interface is also entirely explicit. There's value in modular programming. It's far more reasonable to expect quality from such a MM daemon than the mess in a random monolith kernel.

Secondly, in seL4, physical pages are capabilities. There might be more than one MM daemon, owning separate sets of capabilities to physical pages. Security-critical memory might be managed by a MM daemon your vulnerable process has no capability to talk to.

Just my two cents.
They are kind of the flip side of liberal talk radio, which likewise never gets much traction. I wonder why radio works well for conservatives and social networks work well for liberals?
It uses lzma/lzma2
that was my main problem with "The Lean Startup" too. it was really really hard to finish it when only 10% of the content was actionable (the rest anecdotal)
I love reading her stuff, even if I don't understand a lot of it. Her twitter feed is fantastic.
In many cases, sure, but there is usually an easy way to reset such a device back to its factory defaults.
Thanks. Makes lot of sense.
Also thinking if there is any other good title between CTO (which I feel is somewhat vague and might take my peace away) and Sr Dev.
An Update on Gendered Pronouns
Seveneves is a great novel that explore this idea:

https://www.goodreads.com/book/show/22816087-seveneves
I like this approach:

https://github.com/ellotheth/pipethis

Either check a pgp signature if there is one, or skim the script before executing. Also covers off that pesky dropped connection problem.

curl ¦ sh is too handy to ever die, but it's possible to be smart about it!

Edit: typos
"There is nothing so disastrous as a rational investment policy in an irrational world."

^^

He said that though.
Ask HN: Is it illegal to combat DDOS with a virus?
We have the source for the botnet that seems to have caused yesterday's internet outage: https://news.ycombinator.com/item?id=12766950

Is it illegal to use this same code to go clean up infected devices, and also change their passwords to something more secure? I imagine the changing of the password would be illegal. Is there some action such a virus could take that would fix the problem legally?
What new thing could you not argue for by comparing it to higher crime rate? Why stop with crime? Your argument might be even more compelling if you used cholera as your baseline.
No, I wrote it on my phone and didn't double check the angular example. I noticed another little mistake so I'll edit it
Maybe de gustibus non est disputandum?
> How about stopping for a bit and challenging the IESG (Internet Engineering Steering Group) and IETF(Internet Engineering Task Force) to actually assess the situation at hand, and decide upon actual improvements, creating proper documentation and generally creating a proper professional environment regarding the technology so that you don’t have to open 40 tabs and read documentation that you may or may not need. Making the information more easily accessible and readable means more people will actually go through it and that means more security.

I agree with the author, RFCs are awful to work with. For example, DHCP (because I'm familiar with it). So let's look at the RFC [0], which "Obsoletes: 1541" and is "Updated by: 3396, 4361, 5494, 6842". It turns out, there's about 60 (!) RFCs relevant for DHCP [1], and probably more references in those. What the hell.

An example of reference overload and horribleness through backwards compatibility is the second field in a DHCP header, `htype` or hardware type requires you to look at RFC 1700. It has 230 pages, and some of the hardware types are: Ethernet, Experimental Ethernet, Amateur Radio AX.25, Proteon ProNET Token Ring, etc. Almost all but Ethernet are completely useless today.

Except, oh shit, RFC 1700 is obsoleted by RFC 3232. Which says everything has been moved into a database, but HAS NO LINK to where you might find that database. Now, in this database there are values which require two bytes, but `htype` is only a byte long! Brilliant.

One solution would be to mandate passed RFCs have behavioural tests. In effect, you'd be encoding the standards in a way that computers can understand, and not having the potential error of `human -> computer (txt/html) -> human -> computer (programming)` conversion.

---

[0] https://tools.ietf.org/html/rfc2131
[1] http://www.zytrax.com/books/dhcp/apc/