skysight-inc/HackerNews huggingface dataset:
In some respect, there's been a level of insurance like requirements for some segments. PCI DSS. It's been a decade of so since I had to deal with it, but the requirements were for the most part no nonsense good practices, and instituted a base level of security that was good. Separated DB and application servers. Specific SQL access credentials. Firewalls with pinhole access. Restricted network access for some server roles.

I'm pretty sure this is required because the card industry can't insure against risk accurately without a base level of assurance that your company isn't some fly-by-night IT hellhole. The same concept would likely apply towards any security insurance that was put forth. You would need to certify that certain steps had been taken, and certain future actions would not be taken, for it to be valid.
Location: SF/Bay Area

Remote: no

Willing to relocate: maybe to Boston area

Technologies: Python, AWS (EC2, S3, RDS, etc.), Linux, Flask, PostgreSQL, MongoDB, Cassandra, HTML/CSS/JS, HTTP. Would love to try Rust.

Résumé: http://roywellington.net/résumé

Email: roy.wellington.iv at gmail dot com
Scanadu | Sunnyvale, CA | Full-Time | ONSITE

Scanadu is a consumer medical devices company developing a human-centered suite of products using science and technology to empower everyday people to monitor and better understand their health — anytime, anywhere. This position is responsible for designing, building, deploying and supporting broadly used Cloud-based components used by a diverse set of products and outside partners. The person in this role will be responsible for creating/sharing/collaborating on materials describing the overall platform solution in the broadest and most open sense. This person will also develop a deep understanding of other technologies and potential competitive offerings and insight as to where the market is headed. You will have an enormous opportunity to make a large impact on the design, architecture, and implementation of cutting edge products used every day, by people you know. We are looking for a talented and passionate Senior Data Platform Architect to be part of our exciting team.

http://scanadu.theresumator.com/apply/MBMxbC/Senior-Data-Pla...
> It doesn't cost more to not write a SQL injection vulnerability.

It does.

> It just takes a programmer who has a basic understanding of internet 101

Most likely this programmer will cost more than a $10/hr contractor from a third-world country that worked on the software before.
The primary issue with wildcard certificates is that it encourages certificate reuse between server environments. Even the act of transferring keys around carries a certain degree of risk. With a wildcard certificate though, say you have a very secure shopping site, and a user run forum:

- https://checkout.example.com/
- https://forums.example.com/

Your wildcard certificate for * .example.com covers both domains, and can be shared between both servers. Nice! You've saved a bundle of money on certificates. But there's now a security risk: Say an attacker manages to compromise forums.example.com through some vulnerability in the forum software, and steals the private key for * .example.com. They can now set up their own server hosting checkout.example.com, successfully execute a Man in the Middle attack, and steal sensitive customer data without the end user being any the wiser.

Issuing separate certificates prevents this scenario by enforcing a separation of responsibilities. If each server has its own set of keys, then a security compromise on forums.example.com does not spill over to checkout.example.com, because the key used on one server is useless to impersonate the other. Obviously a key compromise at all is a bad situation, but you want to architecture your environment so that a compromise has the least potential to do damage, and that's the basic argument against wildcard certificates.
what's your problem? it works, end of line.
GitHub Game Off 2016
http://doc.wallabag.org/en/master/
Arcadia Power | Washington, DC, USA | Full Time | Onsite | Full Stack Ruby Developer

Arcadia Power is a nationwide renewable energy company. We were founded with one simple mission in mind: to make our world better by changing the way we power our homes and businesses from fossil fuels to clean, renewable energy. We're already in all 50 states, across 150 utilities, and we're a proud BCorp.

We are looking for experienced software engineers who are passionate about solving complex problems and looking to leverage their talents for a more impactful purpose. We’ve taken a novel approach to building clean energy solutions for our users and make it incredibly simple for anyone to benefit from solar and wind power. Come help us build a product that makes clean energy a real possibility for everyone!

https://arcadia-power.workable.com/jobs/363665
>You could have no security and just get lucky and never get hacked.

It's been a decade and more since that was even remotely true (if it ever was). Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Pwning an unpatched XP box was (very marginally) harder than pwning a system with no security at all. The Morris worm (Edit: which is heavily mentioned in TFA, my bad) [1] got loose in 1998. There's some interesting stuff regarding whether such risks are comparable with things we use insurance to hedge at [2].

[0] https://isc.sans.edu/diary/Survival+Time+on+the+Internet/472...

[1] https://en.m.wikipedia.org/wiki/Morris_worm

[2] http://limn.it/the-morris-worm/
Changing zoning, building codes, and property taxes to encourage more growth but not dictating top down development.
Football Manager 2017 review: Thanks to Brexit, it’s the deepest game yet
GWT has ungone a similar rewrite and we now have a new compiler called J2CL (Jackal) which produces human readable ES6 modules incrementally transpiled on a per-Java file basis, with Closure JsDoc types. With optional Closure Compiler optimization, code-size beats GWT by 10%. Both GWT and J2CL share a new rich JS interop system, and a new Elemental2 code generator can read Closure or Typescript files and produce Java interop classes. The interop can even be type safe, so that you can have compile time checks against third party JS libraries, or runtime checks (instanceof, class cast exceptions)

J2CL gets rid of all of the complexity in GWT (generators, linkers, Widgets), in favor of standard annotation processors, external build systems, and straight up integration with JS ecosystem libraries.

The idea of J2CL was to reduce lock in and make it more of a natural fit with the existing ecosystem. The entire GWT SDK has been nuked for J2CL, there's just the JRE, Guava, and whatever else you want to add, there is no "com.google.anything"

Obviously, this adds a porting overhead when it's released, but some people will likely backport GWT's SDK to it for migration.

This was telegraphed here:
http://www.slideshare.net/CristianoCostantini/gwtcon-2015-be...
https://qconnewyork.com/ny2016/ny2016/presentation/j2cl-futu...
With IoT, this may catch the low hanging fruit, sure. Negligence for poor defaults, fine? But then attackers will just evolve to the next lowest fruit. Keep in mind that to some attackers, finding a software or hardware bug to exploit (and weaponising that), even in highly "secure" systems, is probably just a step or two beyond playing with default credential lists.

The author of this article compares the complexity of the Marai code to that of the Morris worm. It's an apt comparison but not because the state of IoT has gotten worse -- rather it's because we haven't gotten that much better at securing our code, on the Internet at large, since 1988.

What I'm trying to say here is negligence suits for IoT will probably just bring a lot of negligence suits and not a more secure Internet. I believe they would only address the symptoms and not the root of the problem and at great risk to innovation.
And if you've ever wondered what the NS in the Obj-C libraries stands for...
> Fair warning, our parent company is Monsanto

I respect you guys for stating this upfront. Hope you find someone suitable.
IIRC there has been a little bit of work in this area, but there are a lot of downsides.

First of all, it's dangerous because you could "probe" the user's cache cross-domain by offering files with a specific checksum and seeing if they take it or not. Letting evil-example.com figure out if you have visited pornhub recently by offering up their javascript file with the subresource hash attached and seeing if you download it is a massive privacy violation and can cause issues much worse than just knowing you were on pornhub.

Second, Cache sizes are already too small, and while a content-addressable-cache might help with that a bit, it won't really change all that much. You'll still have 100 versions of jquery out in the wild at any time, you'll still have 10,000 different versions of react bundled with other things. You'll still have the version with a UTF-8 BOM and one without, or one with \n and one with \r\n.

Finally, (and this one is just my opinion) it's a solution that encourages worse behavior. It's going to be easier to include that 300kb of jquery when you think that your users will have it cached already. And that just "loosens the belt" around an area where we should be cutting back. Now users that are arriving for the first time will get a significantly worse experience, and that is the starting to go against a fundamental strength of the web, that you can get the same experience on any device, anywhere, any time, whether it's your computer, your cousin's desktop, your friend's phone, or your damn car. Making devices that don't have that in their cache download a massive "basically binary" blob before they can use it is against what the web is, and content-based caching really encourages the behavior of including entire libraries (so they'll be cached) instead of compiling down only the code you need.

While most of this can be mitigated, this just isn't something that's sorely needed. There is an MDN document floating around somewhere that they were talking about something like this, but I can't seem to find it right now.
For me one part of "growing up" in sw engineering has been that I have started to want to pay reasonable amounts for things I use actively.

I see it as an insurance for us users: as long as a significant amount of users are paying keeping the service as-is is a valid alternative for the owners.

When it becomes free I fear that someone suddenly starts looking at it as a cost center, I mean: all the benefits you mention seems to be possible without operating an end-user service.

Disclaimer: not a paying Instapaper customer, but I am a paying lastpass customer and a paying google docs customer etc etc.
I've moved twice in the past four years and I have gone to yelp for food recommendations a few times -- totally useless, sadly. Always wants me to go to Papa Johns or some other chain. The days of interesting food discovery via yelp are over. Oh how the mighty have fallen.
Thanks for letting me know! We pushed some changes earlier today that evidently introduced a new bug.
I wonder how the elections worked all these years without Internet...

Is the media rather concerned they won't be able to orchestrate the voters?
I use React Native, but never use {N}
Some benefit of React Native to me:
- rapid development, I don't need to rebuild every time
- easy to build UI, compared to Native Android
- big community, many ready-to-use plugins
- it has a feature to connect to each natives (iOS and Android). This is very good when third party (e.g.: Cloudinary ) doesn't provide docs / SDK for React Native
- with JS, it's easy to manipulate JSON
There is already PyPy.js using asm.js, doppiojvm which is written in JavaScript, and some effort on getting OpenJDK and/or JamVM to work on asm.js. I don't think you'll have to wait 5 years.
San Francisco; Full Time; Onsite

I'm the cofounder of Figma (https://www.figma.com), a startup in San Francisco building a browser-based collaborative design tool to improve the way designers and developers work together. We're a small team (~20) and we're looking for talented engineers (https://www.figma.com/careers) who are interested in tackling hard technical problems with smart people and building a product that startups will rely on.

If you want to see what we value, you might find these interesting:

- First principles thinking: https://medium.com/figma-design/introducing-vector-networks-...

- Pushing the web to the limit: https://medium.com/figma-design/building-a-professional-desi...

Upcoming/ongoing projects:

- Develop a plugin ecosystem from the ground up

- Build a community of design content and tools from scratch

- Cross-document shared symbols

- Multiplayer editing infrastructure (realtime simultaneous editing)

Our tech stack: C++, Emscripten, Node, TypeScript, React, WebGL, Ruby, Sinatra

If you're interested in learning more about what we're working on or want to meet up to talk about any of my other projects (http://madebyevan.com/), you can email me at wallace@figma.com.
On the Genomics of Disease, from Science to Business
Bad actors are already trying to get that data, no?
What I'm saying is that commuter rail is yet a third category that you're ignoring.

https://en.wikipedia.org/wiki/List_of_United_States_commuter...
Link to preprints for POPL'17 and co-located events
Location: NYC

Remote: Yes

Willing to relocate: Yes

Technologies: Pen, pencil, paper, Illustrator, Photoshop, HTML, CSS, JS, Python, Unix, Git/GitHub

Résumé/CV: https://www.simongriffee.com/resume.pdf

Email: simongriffee@gmail.com

Portfolio: https://www.simongriffee.com/design/
MrSuicideSheep Burning Snowflakes on infine loop

https://youtube.com/watch?v=wGS8gYDIzPw
Eye opening indeed. On a lighter note, I recommend the South Park episode "You're Not Yelping" (S19e04). The full episode is on Youtube (at the moment) and http://southpark.cc.com/ . It has plenty of the usual South Park toilet humor, but it's a brilliant take on the whole Yelp phenomenon.
I'm more up on the situation in Boston than New York but I doubt the conductor checking the tickets is really that high up there on the list of reasons why both systems have financial troubles (at least except to the extent it enables fare evasion, which is apparently quite common).
"Hi I just got something for free and I'd like the opportunity to complain about it now." I mean he said there are no plans to shut it down. What timeframe? You want a promise that for X years you'll continue to receive this service for free, unchanged? They're extending the value. There's literally nothing to be grumpy about.
What I find unusual is they publish tutorials when there are plenty of good sources such as Railscasts, but its like the last 10 years doesn't exist to them and they rehash tutorials.

I think it's normal. I've seen it a lot amongst people who are actively learning. It was common in the late 00s in the Ruby world, and is currently common in the JavaScript, Elixir, Rust and Go worlds. It doesn't matter if they're "rehashing" - they're writing stuff as part of the learning process, we haven't got to read it, and I can only celebrate their enthusiasm. (Plus, on some topics, it's handy to have tutorials rewritten for the latest OS and database versions, etc, anyway since things always change slightly.)
Hedge Fund Manager Odey Says U.K. Stocks Could Plummet 80%
Hacker News is a disaster. It's rigged - you can't even mention Javascript without 10 people - nasty people - saying how everyone who uses JS is deplorable. It's the worst website in history.
The DevOps transformation: How to get there and who to follow
Do you know where to find the rest of the talks from this conference, by chance?
It's still moderately useful, if you know how to read for bullshit reviews and the usual disturbed people, as a way to find out if the place you're thinking of getting food from is alright.
> it would still be one hell of a weird edge case to need to take a drive out of an x86 Win2k server, drop it into an Alpha Win2k server

I can imagine the reverse being more common though - I worked at a shop around that time where we had a handful of very expensive Alpha NT 4 (and VMS and...) boxes, and a lot of x86 NT boxes. I could imagine the magic smoke being let out of an Alpha and having to drop the drive into an x86 box for data recovery.
I would say that payday loans are significantly worse than porn or legal cannabis.

But do people really buy cannabis from spam messages in places where it's legal?
German here.
I'm happy that the whole thing is finally over, but also at the same time very angry that GEMA succeeded in getting it their way, once again. I don't think it's known how much money really changed hands, but knowing Google and the scale of the situation, I think it's a fair bet that GEMA got a huge sum out of this.
Exactly right! The environment pane of RStudio and its related dev & debugging tools are available for use whether you're authoring a traditional script file or an R Notebook. It would be awesome if such facilities were available when working with Jupyter notebooks, but that is not presently the case.
Ooh, that Eric Idle dig at the end...
I wish people would stop fighting you on this. You are exactly the kind of person who should own, or periodically rent, an ICE car. Your situation is unusual, but it's an excellent reason to stick with an ICE. And there are plenty of ways to do your part reducing emissions while still driving an ICE.

For most people, EVs will be better overall. But I wish proponents wouldn't act like there aren't corner cases like this where it doesn't make sense.
Art is one of the tools we use in society to alert each other about issues, i.e. social commentary. The point is, that it's rhetorical so you may be having a reaction that "Yes, I already know this", because you are working from a privileged position of knowledge inside the system being commented on.

Some fairly well-known examples of art as commentary:

Guernica - https://en.wikipedia.org/wiki/Guernica_(Picasso)

Banksy - http://www.relevantmagazine.com/culture/banksy%E2%80%99s-10-...

George Orwell - https://en.wikipedia.org/wiki/Animal_Farm

Given that today we live surrounded by technology, it's not surprising that artists will use that technology to comment about and around our lives, particularly to announce to those outside the sphere of technology how networks, appliances and technological actions actually are affecting their lives.
Wanted to point out the same. It's sort of marketed towards designers/less technical folk, but even to the seasoned developer it represents potentially less time faffing, and should be viable for at least for MVP or personal projects.

Caddy is mostly just unproven at high scale; theoretically, nginx should be able to handle greater loads, but I wonder what Caddy's limits are and how big the difference would be. Haven't found time to benchmark them head-to-head.
You like that, and people like other things.

I hate on board ethernet, it's stupid, almost all of them have only one NIC and only 1Gbps, which is laughable in this day, much more in the 4 or 5 years a laptop usually lasts.

So... welcome TB 3.0 (which can be used for 40Gbps daisy chain networking), and 10GbE adapters someday or another.
Jaunt VR | Palo Alto, CA | Full Time | Software Engineer Openings

Jaunt is a fully-funded venture-backed tech company based in Palo Alto, CA. We are building an end-to-end solution for creating cinematic virtual reality experiences. We have developed an integrated suite of hardware and software to produce the highest-quality immersive content.

We have several Software Engineering openings in the areas of web based application tools development, site reliability, Full stack, general software development, firmware and imaging systems.

https://www.jauntvr.com/careers/positions/
I am actually pretty familiar with (some instances of) the capability model, in particular process algebra-style capabilities, which pretty much don't limit sending capabilities, but also don't need to deal with Unix-style `fork`, for instance. I was just wondering if you had specific problems in mind.

In this case, how would you modify the design? Getting rid of `Kind`, I assume?

If so, how would you enable/disable passing capabilities? By having a meta-capability "I can pass capability foo"? That's pretty much how I would do it in a process algebra, but that doesn't look very usable in practice.
Hi, Brazilian developer willing to learn new technologies, looking for nice projects to work this summer. I have experience building MVPs:

Location:Brazil
Remote: Only
Willing to relocate: no
Technologies: Node.js, JavaScript, Elixir
Résumé/CV: https://www.linkedin.com/in/jeanlucaslima
Email: hn@bitfreedom.xyz
I read the English translation and felt the writing ranged from adequate to tedious, and conveyed little beyond the literal meaning of the words. Certainly some was due to skill composing English, which I assume is due to the translator. But at times there were long, dull tangents, especially (IIRC) into personal histories of characters, that had no impact on the story. I started skipping paragraphs and pages, and it took an effort to reach the end. The Cultural Revolution scenes at the beginning, however, were powerful and left a deep impression.

After that, I picked up a book by Nadine Gordimer, the Nobel Prize winning author from South Africa. What a relief and pleasure - both books used the same language but entirely differently, hers was crafted so beautifully and with so much more meaning in the same number of characters.

Tom Stoppard (whose embrace of serious science should make him HN's favorite playwright - for example, one famous play turns on the Second Law of Thermodynamics), describes the difference between the highly skilled and everyday writer in his play, The Real Thing:

HENRY [holding a cricket bat]: Shut up and listen. This thing here, which looks like a wooden club, is actually several pieces of particular wood cunningly put together in a certain way so that the whole thing is sprung, like a dance floor. It’s for hitting cricket balls with. If you get it right, the cricket ball will travel two hundred yards in four seconds, and all you’ve done is give it a knock like knocking the top off a bottle of stout, and it makes a noise like a trout taking a fly... (He clucks his tongue to make the noise.) What we’re trying to do is to write cricket bats, so that when we throw up an idea and give it a little knock, it might... travel... (He clucks his tongue again and picks up the script.) Now, what we’ve got here is a lump of wood of roughly the same shape trying to be a cricket bat, and if you hit a ball with it, the ball will travel about ten feet and you will drop the bat and dance about shouting ‘Ouch!’ with your hands stuck into your armpits. (indicating the cricket bat) This isn’t better because someone says it’s better, or because there’s a conspiracy by the MCC to keep cudgels out of Lords. It’s better because it’s better. You don’t believe me, so I suggest you go out to bat with this [hack script] and see how you get on. ‘You’re a strange boy, Billy, how old are you?’ ‘Twenty, but I’ve lived more than you’ll ever live.’ Ooh, ouch! He drops the script and hops about with his hands in his armpits ... ‘Ouch!’
My point is it is not the same market to begin with. OVH PAAS and IAAS offer is limited compared to AWS.
It is, don't try to hide it. Apple haters.
If you are the kind of person who uses the word scale when they really mean grow, then macOS Server is not for you.

Most small businesses never have to worry about the problems that come from outgrowing their IT infrastructure.
Tesla's Case for Merging with SolarCity[pdf]
That guy is super long-winded.
As I said, get your facts straight, good.