skysight-inc/HackerNews huggingface dataset:
The "guess the number of jelly beans in a jar" game gave its name to one of the startups whose failure disappointed me the most, Beansight. In 2010, it was asking people their opinion on various topics, attributing them experience points when they guessed right, and using this information about the expertise of its users to improve its predictions.
I'm coming to understand that the chain of evidence is in the following steps:

0. FireEye identifies a threat group known as APT28 (active since 2007) as having Russian origin, based upon political identities of targets, language markers, timezone data, and compiler settings. This analysis is from 2014. [EDIT: added this step later on to solidify Russian attribution] Sources:

- https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... (blog)

- https://www.fireeye.com/content/dam/fireeye-www/global/en/cu... (long-form report PDF)

1. CrowdStrike & SecureWorks identifying the DNC breaches originating from the well-known Russian state threat actor APT28. Sources:

- https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

- https://www.secureworks.com/research/threat-group-4127-targe...

2. This Motherboard article revealing the custom bitly links used in the Podesta phishing email. Sources:

- [OP] http://motherboard.vice.com/read/how-hackers-broke-into-john...

3. Politico confirming with SecureWorks that the Podesta spoofed phishing domain from step 2 has previously been used by threat actor APT28: "'The Google-spoofing domain in the Motherboard article is one we observed used by Fancy Bear,' SecureWorks researcher Tom Finney told POLITICO in an email." Sources:

- http://www.politico.com/story/2016/10/russia-responsible-pod...

This Politico article is the better summary. It also links to 2 other quality corroborating stories from ThreatConnect and Esquire. The Motherboard one is key but doesn't tie the whole story together. Sorry to disappoint parent commenter but the evidence does involve bitly custom domains! I'm not 100% clear whether this was simply a decently-executed vanilla phishing attack or if there were some advanced techniques used, but none of the evidence above hinges on that.
What makes Ceph complicated? The underlying idea and how Ceph works is fairly simple.
Eval has legitimate uses, and there's plenty of ways that extensions can be insecure or malicious without using eval.

Firefox's Addons Marketplace reviews extensions and rejects ones that are malicious or insecure.

The issue is not that Angular uses an inherent insecure feature. The issue is that Angular does insecure things: it lets a webpage run any code with the extension's privileges. If the extension has privileges to your email domain, then the webpage can abuse the extension's privileges to harvest your email. An extension that let your email be harvested would get rejected regardless of whether it used eval or not. (For example, a malicious extension could be made which doesn't use eval and is just a couple hard-coded lines to make privileged AJAX connections to gmail.com. There's no technical features that the extension is using that shouldn't be available.)
FB's Instant Articles and Google AMP are making it harder to publish on web
I've basically only done fixed bid work for the past two years and when all is tallied up the end result is an hourly rate significantly higher than I've ever gotten doing hourly billing. The 'trick' as it where is to focus on offering set products where the scope is easy to clearly define (You will deliver X, I will perform Y and deliver results in form of Z), and that you've done enough times to have a streamlined pipeline to manage. The client shouldn't care if it takes me 10 hours or 100 hours to do something, all they should care about is if the work is worth $10k or not.
I don't buy the scaling argument in the slightest. You can scale a monolith more easily and more efficiently. It's called cookie cutter scaling:

http://paulhammant.com/2011/11/29/cookie-cutter-scaling/

The one performance-related thing that microservices give you is isolation. Say you are a newspaper; you render articles and handle comments. If you have one article where the comments section completely blows up, then with a monolith, requests for comment handling will eat all the CPU and I/O, and articles will render slowly for everyone. If you have separate services for articles and comments, you should be able to ensure that articles continue to get enough resources to be served smoothly.
I'm on call during work hours, and I also work on other projects while on call. Production outages preempt future planning, that's just the way things go.

If someone was in the hospital, that would preempt both production outages and future planning ;)

I agree with the other poster that says "my job is multitasking". Very few people have the liberty of doing only one thing at a time.
It's Better to Buy Than to Rent, and It Probably Always Will Be
Yes, but would you make a phone call with it without looking like a dork talking to the camera? Kodak one looks a bit more discrete.
> Indeed, it took Samsung to develop that technology.

This is a good counterargument to anyone who says Samsung just copies Apple :D
Flying?

If you're stopped by the police, you'll get arrested in flyover country.

If you need to conduct business in a federal facility, you won't get in.
Because 99% of the population have no idea how technology actually works.
Thanks for the feedback, I've made some adjustments so I'm not always pushing a new state on generation
https://www.youtube.com/watch?v=njIc062qmg4

This is really the peak. Ultimately I would argue the show is pretty cynical but does show a world where change is possible.
They have some politicians on their side too: Scott Wiener for example.
> What is the actual evidence that it was the Russians that did it?

If there actually is evidence, it's not public.

In my opinion, the "RUSSIANS WILL KILL US ALL AND TRUMP IS BEST FRIENDS WITH PUTIN" meme is nothing but a scare tactic to influence older voters who were around during the cold war. Obviously, I could be completely wrong. That's just my cynical opinion.
No reason why he should.
Given the saber rattling going on between the US and Russia at the moment, it would seem to matter very much. Blaming the Russians gives them more room to deflect without acknowledging content of the leaks.
Gotta love the dedication with the Dirty COW "swag" web shop and all. Though something tells to me it's just a strange in-joke. Might be the prices? ($1,000 for a mouse pad .. oh, really?)
Wait, the account didn't have two-factor auth enabled?!?
fair enough (and yes I now remember that it did have an Ati sticker on the front - you're right), but the point is that awesome gameplay is not a positively sloped function of hardware power. The correlation, once certain thresholds are met, appears to be zero if not negative.
Airline On-Time Rates Are About to Get Worse
Anddd I’m fired. Thanks TechCrunch
I won't argue against the idea that we have too much classified. It's expensive and counterproductive to try to protect things that are no longer important. That said, 50 years ago, we had detailed and effective designs for nuclear weapons - likely well beyond what's known by, e.g., north Korea. There are probably people alive who'd be placed in danger by the release of information from 50 years ago. Not many, but 50 is within the lifetime of someone who was undercover at age 25. I'm not sure that such a blanket 50 year declassification policy is defensible.
It's less of a mouthful than, "practitioner of the dark arts and lay member of the Esoteric Order of Data-Gone".
Yeah, if you're going to go that far you'd get hassled in places -anyway-... so may as well make it a nice Guy Fawkes mask.
A company's stated values and mission are often at odds with it's revealed preferences. Employees respond to the latter, which show themselves via what kind of behavior gets rewarded/ignored/punished.
> Why on earth is this organization still allowed to operate at all?

If you look weak on "National Security" you lose your next election campaign the vast majority of the time.

That is really the entirety of the reason and its frightening how disconnected our election process is from the reality of the results they produce.
Bryan Cantrill's lightning talk: https://youtu.be/bg6-LVCHmGM?t=3521
Where Your Startup Is Most Likely to Survive Until Its Next Round
I've looked at this. Easily the best deal in town. A few notes for people considering it:

- It's IP transit and a DC from HE, which means it's possibly not BGP peering through other transit providers? If this is true, if HE's network fails, so does your server's internet connection. Typically you want to be multi-homed to ensure redundancy, unless you're doing something like an Anycast CDN and you don't care if it craps out for a few hours.

- HE is the cheapest transit for reasons. It may not be a big deal for what you're doing, but be aware of the differences https://news.ycombinator.com/item?id=5348624

- They only provide a 15A circuit (likely only 80% usable) for a 42U rack, which is pretty ridiculous. You'll blow through that pretty quickly if you're using dual Xeon servers. It's cheaper under their pricing to get a second 42U rack than it is to get the proper amount of power needed for a full cabinet.

- If you're doing Anycast, be aware that HE doesn't provide any BGP communities except blackholing, which could make it hard to tune your network.

(If any of this sounds annoying to deal with and think about, you know exactly why I'd prefer that the cloud providers had better BW costs so I could not have to do this anymore. Again, if the business model works with GCS, congratulations, use it.)
A new Major version of Speedment Stream ORM for Java 8 is released
IBM says it is 3X more expensive to manage PCs than Macs
The end user doesn't know or care about implementation details. It's bikeshedding that nobody cares about except the developers themselves. Facebook could have built their web app with Angular or Ember or whatever and nobody would give a shit except developers. Even as a developer I don't give a shit about what framework a web app I'm using is made with as long as it works (if it's horribly broken then I know what to avoid).
Hillary Clinton managed to generate 60k e-mail records over 6 years; assuming a period of 8 years, and a similar rate of e-mail generation, it would only take 6250 employees to generate 500M e-mails. The NSA is estimated to have 30k-40k employees (and many contractors).
I created http://benchurch.me/hackersearch a tool to search who's hiring threads using react and found it to be a great starting point for jumping off into the library.

It was simple, had a single external data entry point, was a suitable use case for diving into functional paradigms and has a lot of room for extension in the future as I continue to learn

You can see the source here if you'd like: https://github.com/bechurch/HackerSearch
Yeah, I was thinking "oh man, dotTK, the memories" :)
I would have to first believe that my company actually has values before I could believe that I share any of them.

The only corporate value that I ever took at face value was "Make money." I'm not sure who must have had a stroke that temporarily disabled their executive dishonesty gland long enough to slip that into the corporate culture, but I hope they survived it.

Literally everything else has been blatantly obvious employee propaganda.
I think a lot of the time we do have a good idea why a certain neural network is better or worse at various tasks. The core problem is that the ability of the network to work is is a function of the nature of the domain as much if not more so than the networks themselves and it is very hard to get an understanding of the shape of the problem space aside from post-hoc insights gained from what type of networks work well and which don't in that particular domain.
Sounds similar to http://www.almanis.com
Automate borg backup with Node.js
Watch a fully autonomous Tesla drive through the city and find a parking spot
Learn how to remove things in O(1) time with Java 8
I don't have data to back a disagreement, but I'd be interested in what data you'd show to back your assertion that the money's in theft and extortion?

In particular, I'd wonder what the cashflow behind dark drug markets looks like in comparison (not that I think that should be illegal, and yes, I accept that any data there would have to be estimates at best)
What else? I was creating this for Youtube videos for my son. When we were about to upload a video, it was already banned.
Image Synthesis from Yahoo's open_nsfw
Links please? Any actual library produced and linkable, even with just one algorithm? I can't find it behind that Ivory link? Thanks!

Edit: also thanks for explaining the nature of the solutions you mention ("custom jobs").
"Oh, you can just" is usually not good enough.

I specifically made that comment because I upgraded my phone with an SD card. It's nowhere as good as having enough storage built in; and I'll never buy a phone where I have to augment storage again.
That must be a hell of a piece of software then!!
Someone please correct me if I'm wrong, but my understanding is in Rails you still need to define every action in the controller. With DRF, you just inherit from a ModelViewSet, declare the queryset and serializer on the class (or have methods return them if you need custom behavior), and you're good to go. It makes prototyping so much easier, and adding filters and permissions is very straightforward.
>1. Say hypothetically if AngularJs can do it, doesn't that mean any Javascript can do it too? I mean Javasript contained within the extension code?

Angular doesn't have a monopoly on insecure code! Anyone can write insecure or malicious code. Firefox's Addons Marketplace will reject an insecure extension just the same when they notice anything amiss whether it uses Angular or not.

>2. In chrome extensions we use "ng-csp", otherwise it won't run. Is this addressing the same thing in chrome and if so, why can't it do it in firefox?

Chrome enforces a CSP directive that prohibits eval in UI pages. This is unrelated to Angular being insecure to use in extension content scripts. (When I've said a few times that Angular is insecure because it "evals content from the DOM", I'm not trying to be specific to the `eval` function. I think its CSP fallback is just as insecure.) Angular 1.x is bad news in Chrome content scripts just the same.
Scala, Akka, and Play say hi!
I would also like to know the answer to this question.
Pretty similar yes. I didn't know that one, thank you.
I suspect that believing in the company's values is the sole province of the Organisation Men:

http://www.ribbonfarm.com/2009/10/07/the-gervais-principle-o...
Technically Canon and Panasonic have competing models ;)

But yeah, someone on G+ asked me, "did you get rid of your DSLR?" because all I ever post are RX100 pictures these days. I did not get rid of my DSLR, I use it for "studio" stuff, but for going out and about the RX100 is the best possible currently-available camera. (It could be smaller. But that 1" sensor is just amazing, often yielding 21,000,000 usable pixels. My iPhone just yields photograph-styled noise reduction artifacts.)
It will be interesting to also find out what percentage of employees think culture decks are bs as well.
It's a great counterpoint because with a large staff you can never solve the human element. It's also corollary to the hacking approaches we see regularly employed: Send an exploit payload via email to everyone in the company and somebody is bound to open it. In fact in the security space they've moved away from even saying you can protect the front door and are more focused on detection and correction once an intrusion occurs.
I hope that Arch will take off on WSL [1], it's early stages still but it would be good to not be limited to ubuntu.

1. http://www.infoworld.com/article/3120888/open-source-tools/n...
Kubernetes: Critical Security Bug in TLS Client Auth
> If I had to guess, the most likely outcome here is going to be that we are talking about someone with very serious mental health issues who NSA had no business putting within 1000 miles of the information he managed to hoard in his house.

I agree with you.

That said, this statement is at odds with your statement in regards to lying.

> The filing described Mr. Martin as computer genius who easily outsmarted government efforts to protect secrets and said he possessed an advanced understanding of how to encrypt messages and hide information in cyberspace.

They are certainly lying in terms of how capable he was with the "genius" implications.

The simple truth is NSA internal security is fucking terrible as we are shown time and again that lone wolves are easily able to do this if they so choose. Snowden isn't some magical computer genius of exceptional ability either. He honestly comes across as more of an above-average (but not 1 in 100) IT guy.

I'm willing to bet Martin is "above average" but, once again, not a computer genius mastermind capable of outsmarting competent security practices. It is simply the NSA is not competent at implementing such practices when it comes to internal actors.
Herman Miller Just Redesigned Its Iconic Aeron Chair
They certainly should be able to, if they can show their algorithm actually does better on real world datasets.

But that's not my point. My point is that CS people can actually formally prove things about their algorithms. They can make reasonable assumptions like "if the data is randomly distributed". Machine learning can't make strong assumptions like that, and they can't formally prove anything. Expecting anything like formal proofs for machine learning algorithms is unreasonable because of the no free lunch theorem.

The same is true for sorting algorithms, if you remove the assumption that the data is randomly distributed. If you don't know how data is distributed in a real world problem, then there is no way of proving what algorithm will do better. You just have to test them empirically.
For some people, email is not a big part of their lives, and it's probably fine to have a free service. But I'd argue almost anyone for whom email is a daily necessity, you should be paying for a certain quality of service. I mean, your email is the core of your online identity, and if it vanishes, such as the dozens of stories we've heard of Google terminating people's account without warning, it can be devastating to put everything back together.
Isn't use case proposed by PurpleJS covered by Vert.x already? Or am I missing anything?
SS7, phone numbers and telco stuff are built on trust, with a 1970s/1980s business model when the only people messing with the system was the ILEC.

It's trivially easy to fake scanned documents proving that you're authorized to port a phone number from one service to another. In this case there was probably no SS7 messing about at all, just somebod falsifying the info or socially engineering his cellular carrier to transfer the number to a new phone. Mitnick's "Art of Deception" book is an authoritative resource on this problem.
حادث في مطرح الكورنيش، مسقط، عمان
I'm curious what exactly will the "haptic touch" technology of the dial be? Do you know of any consumer-grade products with (hopefully) non-buzzer haptic feedback on touchscreen available on the market yet?
We can teach intuitive integral calculus in kindergarden:

Have lots and lots of ping pong balls handy, and try to measure the volume of everyday things in ping pong balls.

Exact results are not a requirement and in fact they don't matter at all for this early age, only the intuitive visualization.

We can teach the concepts of squares, cubes and prime numbers using the ping pong balls as well: Get for example nine balls and form a square shape. Squares are numbers that can form that shape. Similar for cubes. Factorization in two factors is arranging the balls in a rectangle. A prime number is any number that can't be arranged in a rectangle.

All this is intuitive, children can understand it easily, and it will help them in the future.

And all this is before they learn about equations and algebra, it's even before fractional numbers.
Those are good points. Even if the limit was 75 or 100 years for things like that, it would likely be possible to declassify all but a few "black box" details of the tech. That's the most defensible use of secrecy, since the precise way in which it works is not likely to be the basis for a conspiracy by officials against the public.
First, my post said 'essentially meaningless', which is to say 'possibly not completely, but for the most part, meaningless'.

Second, the context here is whether or not the type system of a language is strong or it is weak.

I stand by my assertion that describing type systems as strong or weak typing is essentially meaningless. It's so far from descriptive that all 'strongly typed' ever really means is 'I like this feature' and 'weakly typed' means 'I do not like this feature'.

There are alternative, accurate ways of talking about what people think they are trying to get at when they use the terms strong and weak in relation to languages. They should be used instead.
Fermor's biography by his friend Diana Cooper's daughter (Artemis) is an incredible, rollicking piece of work, like the man himself.

http://www.nytimes.com/2013/10/27/books/review/patrick-leigh...

After plowing through his wildly manic, romantic travels and escapades (including the most daring raid of WW II, when he kidnapped the commandant of the Nazi occupation in Crete mid-day), one feels very small and un-alive by comparison.

What a life! (Though, ultimately you get the sense that he wasn't fulfilled by all the escapades.)

Absolutely worth a read.
It's plausible only in spirit. An actual listing of terrorists does not have 3 terrorists within a 1-mile radius, and does not need volunteers; the FBI already has such a database. But as recent terrorism has shown, the databases are not be sufficient to prove or disprove terrorism. It's just more security theater.

If the FBI started extending its database to more trivial crimes, like say speeding tickets, then it might start being useful. A law that isn't enforced evenly isn't really a law; it's an excuse for the police to harm people they don't like. Computerized enforcement seems like a good goal to aim for.
It's animal leather, at least that's what can be concluded from a quick Google search.
> 2. In almost all cases, whether or not there's a known local privesc bug, assume that code execution on your Linux systems equates to privesc; this is doubly true of machines in your prod deployment environment.

I think this goes for any mainstream OS, Linux is not particularly special here.
Great article, surprised I missed that one from Hoodline.

HANC is still around actively blocks housing projects in the Haight. For example, the Whole Foods on Stanyan and Haight was to be mixed use, but HANC (lead by Calvin Welsh) fought to block it. See: http://www.socketsite.com/archives/tag/690-stanyan

I agree that NIMBYism is a double edged sword, and this is where changing how people think about transportation and growth comes together, not changing who people are.
We detached this subthread from https://news.ycombinator.com/item?id=12756301 and marked it off-topic.
"Johnny: "You talk in parable´s. I can´t wait to see you""
I would never write back to somebody who uses the Idiot's Apostrophe.
Outdated estimate, but better than nothing:

https://duo.com/blog/estimating-googles-two-factor-2sv-adopt...

Seems to point to likely less than 10% of users having 2FA enabled.
No, the screen w/ "Google stopped this sign in attempt" is not from Google. Presumably the "Change Password" link pointed to a server controlled by the phishers.
I couldn't tell if I was serious or not when I made the comment!