skysight-inc/HackerNews huggingface dataset:
One option is to avoid putting the token to the link and at least provide user a simple way of copy-pasting the token to the password reset form.

Sometimes this is actually something I as user want to have, since it might be that I'm receiving the email on device A, but want to reset the password on device B.

And please keep the password reset tokens sane. If you are not encoding some data into the token, you don't really need that 80 character random string for security.
Every now and then, Reply All https://gimletmedia.com/show/reply-all/ has a segment that is Tech Support. Some of the items on there are down right bizarre but very plausible. Great listening.
Forwarding Logs from a Docker Swarm Cluster
My answers to your questions in order: I don't know why. Yes. I don't care. And I don't care.

I'm sorry you feel bad. I'm sorry the world has bad people in it. How do you propose we deal with a world that contains such people? Do you think things like 'raising awareness' or writing blogs about it is going to stop the trolls from behaving like this? Because it hasn't worked so far.
Just install NewPipe and you can download YouTube videos to your phone, or only download the audio. [1]

Works fantastically.

[1] https://f-droid.org/repository/browse/?fdfilter=NewPipe&fdid...
No Dependencies Material Date/Time Picker for Mobile Web
Overbooking in the hotel industry is a normal practice. Cancellation rate is pretty high. Hotel Tonight deals with the last minute inventory, overbooking here would result in unsatisfied customers.
I worked for an online hotel booking site in the past. We had integrations with multiple GDS and channel managers, SynXis (Sabre) was one of them.
SynXis was not the fastest or most accurate when it came to inventory. SynXis had some ridiculous throughput limitation to query for availability, luckily we did not have to rely on that API.
I can't speak about original Sabre technology since I haven't used it myself.
Show HN: Sudo make me some iMessage stickers
The most common other need I've seen is file locking for binary assets, which GitLab also does.
'social-problems-of-lisp
I was going to mention the "Surveillance under Surveillance" project you linked as well. How's the project OP posted any different, other than that the mapping libraries and the map data don't seem to be open and they probably don't have as much data on camera locations yet?
we could start by getting an asteroid into orbit, this could be used as orbital station, construction site and counterweight for a future elevator
Also, https://github.com/pixie-lang/pixie
AI TLD is Down
How to implement this if the token is not stored in database at all (eg. JWT)? As far as I know, enforcing one-time-use only requires storing a bit in backend.
How many of those are a) left and b) still maintained?
Are you sure about that - I didn't think Wine had a 16-bit emulation so how does it work?
You can make that happen.

Get a channel going on YouTube, get a following. Pitch it to NPR. Watch it get picked up by a cable network after a few seasons, perhaps.

Sort of "Wayne's World meets Top Gear for computer geeks". I'd watch it. I might even pay to watch it.
I think it likely will because GBP as an export currency has lost almost 20%. It's just not as interesting a deal. Unless wages are forced up to attract foreign pros which ends up being a further hit to business.
I've been pretty much exclusively project-based with my Upwork fees. You're right in that it's usually a risk, and scope-creep is always a potential issue, but it's worked out relatively well in my experience. I usually go out of my way to provide the client with my own detailed task summary regardless of his/her job posting content, to ensure we're on the same page and to give us both a flag-in-the-sand as a reference.

The more you work with a platform like Upwork, the better you get at quickly labeling and filtering clients/gigs, and the better you get at finding similar jobs to successful ones you've completed. That's when project-based fees are great because you can trim hours by creating a system and/or template that reduces your project hours over time.
Xamarin – The King of Cross Platform App Development
Would love to get some tips on this! My top questions are: (1) how to evade detection of this by Upwork? (2) how to ensure payment from the client without the escrow service?
This is a big problem in many European cities. Many people in cities (and just about all in city centres) don't live in a house, they live in a flat. And while the newer ones in very large cities often do, most older apartment buildings don't have parking garages. I think my neighbours would be mildly annoyed if I were to lay a 30m power cable from my third floor window to my (hypothetical) EV somewhere close to the house. Not to mention the strangulation issues for those nasty pedestrians on the sidewalk in between house and car.

Having an EV-only inductive charging parking spot every here and there might help in the future (https://en.wikipedia.org/wiki/Inductive_charging#Electric_ve... - it's coming), but probably will neither be cheap to retrofit nor very practical.

This is an issue that needs to be solved for EVs to become practical here.
Whats wrong with Netflix? They are one of the few publishers creating large amounts of content specifically for mature audiences. Their revenue model is not based on advertising so they are free to create quality content rather than content that will simply appeal to the most people.
A bigger issue (as the NYT correctly postulates) is the industrialisation of cybercrime.
Given any set with a partial ordering you can construct a category whose objects are the elements of that set and that has an arrow from a to b if and only if a <= b.
Does ECC memory make this harder to pull off? I was under the impression that ECC memory does not mitigate rowhammer although it may make it harder[1].

> Tests show that simple ECC solutions, providing single-error correction and double-error detection (SECDED) capabilities, are not able to correct or detect all observed disturbance errors because some of them include more than two flipped bits per memory word.

[1] https://en.wikipedia.org/wiki/Row_hammer#Mitigation
There are some very interesting discussions on government and electorial constructs(for lack of better word) in different countries and pros and cons of these, in the comments here.

Can anyone point to any good documentaries, books or other reading digging a bit deeper into this subject? Given the focus on the US election at the moment and a lot of people seeing it as two bad options, then why is the US system like that and in for instance Denmark where I'm from we have multiple choices. What's the history behind each, pros and cons etc.
LinkedIn's free week of learning
Big Data Efficiently Scales Staffing with Passenger Demand in Airports
I think it's likely that much of what is said right now is posturing for the domestic populations. However I don't think it's in EU political interest to offer the UK a good deal.

I fear we will end up worse off overall but what I particularly want to know about is how it will effect dev...
No, the Universe Is Not Expanding at an Accelerated Rate, Physicists Say
> For the last couple years (ish?), the moderation regime has been really active in trying to get a good mix of stories on the front page and in tamping down on gratuitously mean comments. But there was a period of years where the moderation could be described as sparse, arbitrary, and capricious, and while there are fewer “bad” comments now, it doesn’t seem like good moderation actually generates more “good” comments.

I agree that there was a major change in moderation 1-2 years ago. But I think it's worse rather than better. The moderation is more arbitrary and capricious now (in particular it's a lot more active during the hours when the US is awake), and there are a lot of positive-but-contentless fluff comments and even humour, both of which are inimical to what made HN great.
I work for a huge bank and the system of record thing is spot-on. I don't think there's any law that says we must operate systems of record in certain ways or keep records of every little thing but remember that this is banking. Keeping records of every little thing is practically the religion of banking!

So for a long time now the big banks have been trying (and often failing) to keep track--centrally--of every little server or device that pops up on their networks. So there was a big push recently (few years ago) at the big banks to improve their systems of record. The goal being mostly related to better financial (asset) tracking. So they can figure out which internal teams were using the most/least resources as well as figure out who's not upgrading their stuff on a regular basis (technical debt builders).

So they spent all this money improving their systems of record and in walks Docker. It practically turns the entire concept of having a central place to track "systems" on its head!

To give you an example of the difficulties: We have loads of policies that say things like, "all systems/applications must be registered in <system of record>." Sounds simple enough: Just make sure that wherever a Docker container comes up we create a new record in the system of record and remove it when it comes down.

Except it's not that simple for many reasons the most obviously problematic of which is that the "system of record" works in batch. As in, you submit your request to add a new record and then maybe 8 hours later it'll show up.

Did I mention that there's also policies that say you can't put any system into production until it shows up in the system of record? =)

That's just scratching the surface though. Because the system of record at most financial institutions doesn't just allow you to delete records. Once you create one it is there forever. It merely gets marked as "retired" (or similar) and most banks require phases as well. For example, before a production system can be marked as retired it must first go through a mandatory, "waning" period (what it's called depends on the bank) that can often be weeks.

I can go on and on about all the zillions of ways in which systems of record (and the policies that go with them) are anathema to usage of Docker but I think everyone reading should "get the picture" at this point. If not, just imagine the havoc that would entail when you have thousands of Docker containers coming up and down every second. Or the entire concept of a container only being up for a few seconds to perform a single batch operation (banks love batch, remember!).

If you think the system of record requirements make adoption of Docker difficult you should know that the security policies are worse! Imagine a policy that states that all systems must undergo a (excruciatingly slow) security scan before being put into production. That's just one of the headaches, sigh.
Not saying that either of these systems is better but when I look at the cost of the presidential campaigns in US, it seems almost impossible to be an excellent but poor newcomer [1].

http://www.investopedia.com/articles/personal-finance/111815...
I run a consulting/support business around Prometheus.

I've found that giving talks and weekly writing blog posts (https://www.robustperception.io/blog/) are great for acquiring customers. Beware though it's often at least 6-9 months before any of it directly bears fruit.
Child refugees in Turkey making clothes for UK shops
There's a wide range of scaled resolutions with the retina MBPs. I usually go somewhere in the middle to high resolution space. My brain can't handle the jaggies I see when I use my MacBook Air 13" now.
The article is simply pointing out that services which record referrers can inadvertently store live password reset tokens if you're not careful.

For instance, someone places Google Analytics in the head of the default layout for a given site. Now traffic to and from the password reset page, which uses that layout, is being recorded. This means an attacker would only need to gain access to that account, which is probably much less guarded, and gather referrers containing password reset tokens. From there they could quickly try the last few--which might still be active--and easily gain access to one or more accounts within the site.
The Designers Guide to Git
> An EC2 VM is not like a physical server in that it will not continue to run indefinitely until something breaks.

Sorry to contradict but an EC2 VM does run indefinitely until something breaks ;)

There are differences in physical storage between local disks, SAN, NAS, Network Storage, NFS, EBS volumes and Google Volume. A sysadmin should know the characteristics of these, doesn't matter whether it's cloud tech or own tech or homelab tech.

People with all this knowledge are rare and expensive, yet critical for major migrations to go well. I can understand that this is an obstacle for major migrations to the cloud (and a benefit for my payroll).

> You've just said "There is no need... if it's not needed".

I think it's VERY important for legacy migrations. A migration should be done starting with the fundamentals, progressing in stages.

All articles and talks focus on shiny bleeding edge stuff, which is only the latest stage(s). Depending on the applications and organization, this stage may or may not be worthwhile, it should or should NOT be a goal in the first place.

> If it is not possible to use the surrounding services your application is probably a poor fit for a cloud platform. It can become prohibitively expensive to try to directly replicate your physical datacenter architecture on a cloud platform.

I'm talking to clients who have to run their own datacenter right now and want to migrate. It is prohibitively expensive.
Spotting the difference between 1080 and 1440 on a phablet is one thing, but if you can't see a world of difference between 1080 and 1600 on a 13 at a typical laptop distance your vision is not perfect.
Exactly my thoughts. Also, despite the message being carved in stone, after only 70 years it has deteriorated already. "There is XXX danger to visitors". Irony?
Here's a similar list on GitHub for Remote Work (with less of a Freelancer bent than the OP)... it's not maintained by me, I just stumbled upon it once a while back: https://github.com/lukasz-madon/awesome-remote-job/blob/mast...
165 PPI is low resolution? That's almost the same as a 4K screen @ 27 inches. Would you call that low resolution? That's "retina" at a 21 inch (53 cm) viewing distance.

Once you hit "retina", increasing the resolution provides rapidly decreasing benefits.

http://isthisretina.com/
You're writing your driver in LUA? Am I missing something?
Anybody knows how/where to find clients from Europe? As a software developer?
Also, you don't have to charge per project.

If you simply don't charge per hour you're filtering many clients out already.

The bigger the period is you charge on, (day, week, month etc.) the less people find you interesting, because they just want you for 5hours/2day/1week etc.

On the other hand you have to ask yourself, do you want to work with those people? If yes, charge per hour, if no, don't charge per hour :)
The thing about https only applies when an https page is loading assets from a non-http address. But if your site uses https and so does your CDN, then the referer headers are still sent.
Doesn't that mean your OS is rather broken as well?
Show HN: My First Vue Project – Aces Up
Where did you see that. The only price I saw was 867 euro which is much more than I was expecting for something like this. Aren't Macbook Airs about 800 euro?
QHD+ (3200x1800) is, IMHO, absolute overkill on 13" screen and have only one purpose - to show "mine is better than yours" numbers in the spec list.

As a comparison, MacBook Pro, the laptop that invented "retina" laptop display, have 2560x1600 on 13". I dare you to spot the difference between 13" MacBook Pro and any current Windows laptop with crazy high resolutions when the fonts are the same size.

BTW, 15" MacBook Pro have 2880x1800 (still below QHD+), and 12" Macbook have "strange" resolution of 2304x1400 - Apple cares about the battery life and packs reasonable number of pixels on the screen. Other manufacturers probably don't have so much weight and confidence in their products, and packs any available high-res display into laptops. But let's don't confuse bad logistic and sloppy manufacturing with economical use of display and battery.
> howp

“how?” is not a predicate (i.e. something that returns a Boolean value), so it wouldn't be named howp.
I think you're confusing DDIO with DCA. DDIO is Intel's mechanism of allocating L3 cache ways to DMA, and works for any vendor's card. DCA is an older set of steering hints that cause per-TLP steering hint flags to influence whether or not a DMA write ends up in the CPU cache. DCA is highly targeted, and much more effective in realistic workloads because you can be smart, and cache just descriptors and packet header DMA writes (eg, metadata). With DDIO, you end up caching everything, and with a limited number of cache ways, you end up often caching nothing, because later DMAs push earlier ones out of cache before the host can use the data.

At a previous employer, we figured out the DCA steering hits and implemented it in our NIC. Thankfully enough of our PCIe implementation was programmable to allow us to do this.
I didn't say I can't see the difference, I said I can't use the difference.
This requires non-idempotent get requests as you must invalidate the token on get.

I did consider this approach for Clearance and intended to go with it, but was discouraged from doing so after hearing reports that some enterprise email AV does things like open some links in emails.

There is also the user experience concern that a click the link in my email, do something else, then click the link again, having forgotten I already clicked the link. Now I'd have to re-request again.

Also, this approach is impossible if you use HMAC tokens.

I don't think anyone who opts for this approach is wrong but like most things, it's a tradeoff.
Very cool idea. I've just added my library to the list of libraries (opened a PR).
Everything to Know About the Calais ‘Jungle’ Closure
I think your point is the strawman. I never said it was "perfectly ok" to be a jerk. These people are arseholes. But I hate to break it too you... It's not real! It may have a high level of realism, but it is not reality.

In the real world, when someone is groped, they can't just press a button and vanish. If they could, they would! And because they can't, they are abused against their will, and as such, it is a crime.

You know, it's not a human right to be able to play online games. I don't remember anything in the UN charter about the right to only be exposed to nice people when in VR. I don't play online, multiplayer games. They are complete cess-pits. But I don't have to play them. I can just choose not to play them. And so I do. And I'm not gonna start now just because "OMG! It's in VR."

She exited the game. Good for her. She has the power! Like the message in the movie Wargames: The only winning move is not to play.
Needs file locking too. Looks like GitLab sort-of has you covered, though: https://docs.gitlab.com/ee/user/project/file_lock.html

On the other hand, it seems like it makes you wait until you're trying to do a git push before you find out somebody else has it locked already - which seems a bit cruel. The more traditional approach is for the file to be read-only in your working copy, and you use the version control client program to make it writeable (and it then performs the appropriate checks). So if you omit to consult the client program first, you'll get no further than your first attempt to save before you find out.
To me it actually sounds like more. That would mean about 324 parties in the USA.
This is nonsense. Not every system in banks needs to be highly available. That's just silly.

Like the print server on the 3rd floor needs an active standby! Haha.

No, just like any organization banks have "critical" systems and "everything else." Docker is mostly being "sold" as a means to replace and improve the non-critical stuff. Like that internal web app everyone uses to look up <whatever>. Or the system that generates daily reports on <whatever>.

Just like most organizations, banks have a few critical systems and everything else is less so (to varying degrees).
Doubling your skill (and experience) can quadruple your speed.
Well this sounds exactly like the project I ran for the local Pirate Party during Slovenian elections - nadzorovan.si ("you are monitored" in Slovenian).

You can see the map of cameras here: http://nadzorovan.si/zemljevid (we targeted the capital city center for coverage).

Anyway the original hack was simple - you use your normal camera with geotagging enabled (and a sports app running in the background for better GPS coords) and take pictures of cameras. Activists than sent it to me, I ran it through a basic PHP script that resized the images, stripped the EXIF data and constructed a JSON that was displayed on a map.

We upgraded it to the current status - nadzorovan.si - a year later but due to time constraints have been unable to finish the mobile apps that simplify the image taking and upload experience and enables us to incorporate non-Pirate activists. The code will be open sourced (it kind of already is, it just isn't on github) and the dataset is entirely public.

We plan to restart the project in the spring. There are a whole host of issues with a project like this - if anyone's interested I can go into details.

I should note the project was very well received in the public.
Author here. I completely agree that it's unlikely to be exploited but also think fixes are mostly simple enough that it should be addressed.
Hence one of the proposed solutions at the end of the article is to generate a new token when the link is used and put the new token into the form.

But some sort of token needs to be used even after clicking the email link because the "enter a new password" form needs it posted as well (to prevent people from using that form willy-nilly on any account).
Sales Process Talk with MadKudu [Live]
I have never heard anyone arguing about whether the death penalty is an effective deterrent. It's about removing murderers from humankind as soon and as cheap as possible.
Nowd – handy development tool for Node.js
It's covered in the article, but this is not supported by IE11. That's pretty modern...
Mental illness has two components. Brain chemistry or health is one. Social crap is the other. The article addresses a factor in the first category. Even if someone is treated extremely well, if their brain is impaired by nutritonal deficiency or disease, they won't think right. These are both important factors and not really interchangeable.

You have a valid point with regards to mistreatment being causative. But being kind does not cure nutrient deficiencies per se. Supplements can cure that piece.
Being German I want to pPoint out that the article leaves out one cruicial detail: Building your own home puts you into debt for quite literally the rest of your life. We do not like debt.
Any observed statistical regularity will tend to collapse once pressure is placed upon it for control purposes

Goodhart's Law : https://en.wikipedia.org/wiki/Goodhart%27s_law
Passive income is just an alias for a delayed active income with uncertain ROI.
Microsoft to hike UK enterprise prices after Brexit pounds sterling
I'd certainly consider this for some applications. It depends on the value of what you are protecting. For some sites and users, the error rate introduced by this method would be unacceptable.

Tradeoffs...
Show HN: Mustachio, a pull-streaming Mustache engine
Honestly, making things up is exactly how we prove if it works or not. For example:

Suppose I can talk into a tiny little device and someone can hear me from miles away.

That sounded like witchcraft at some point but it became a reality. Futuristic thinking needs to suppose lots of crazy-sounding things are possible.