skysight-inc/HackerNews huggingface dataset:
That is true. But, if I'm running my own instance, the probability is that it doesn't matter if someone else gets access via bad application logic. Everybody is probably employed by the same company.

It's a difference of degree: compromising my self-hosted or on-premise server means that somebody already in my employ has more access than they should. If I'm a small organization, that probably doesn't matter. If I'm a big organization, I probably have an IT staff to deal with this and the people involved are still "nominally" under my control.

The github mistake means that people completely unrelated to my repository can get access.
...Or even Mumble.
I recently helped build a secret store system for our infrastructure, and we decided to not use Vault.

A big reason was that Vault’s AWS authentication backend is not based on AWS infrastructure like IAM/KMS, but uses a somewhat backhanded method (https://www.vaultproject.io/docs/auth/aws-ec2.html) to establish verify an EC2 instance. We use ECS, and it doesn't play well with it - see https://github.com/hashicorp/vault/issues/1298

Instead, we would have had to fall back to the App ID method, which requires separate configuration, and is “Trust On First Use” so doesn’t offer as strong of security guarantees in my opinion.

Also, the only Hashicorp supported-backends are file (non-HA) and Consul.

If you're all-AWS, I'd recommend checking out Confidant/Knox (run as a separate service) or Credstash/Biscuit (run directly against AWS infra).
What, this mind dump that you called README? Hardly.
My mistake. And thanks for the correction! I read of the story when it broke a few weeks back, and honestly it didn't surprise me one bit at the time (were Microsoft have attempted such a maneuver). I quickly posted the link without following up on the story... only to realize the err in my ways. Good looking out. Cheers ;)
A Japanese Billionaire’s Robot Dreams Are on Hold
If you have private repositories that should never be public, no matter what, which isn't true for most users of private repositories, then:

Given that git provides many transports and ways to push commits around, I agree. If you have to be safe, there's no reason to use github or a self-hosted git collaboration service (gitlab, etc) on a publicly accessible server, regardless of access control measures. If you really need to have sources on a remote machine, you can limit the potential damage by only sharing archives of a certain revision, without history.

I know many will dismiss it, but if you're serious about the repositories being private, then the most you make them accessible is via an on-premises hosted gitlab instance, which is local to the company network, not accessible via the public network, and only allowed to, if you want, by dialing into VPN first. Then, to be safe, you null-route anything but the VPN traffic on the connected off-premises developer machine.

Access keys get stolen, just like SSH keys are, so you need to use a VPN service that requires additional security like the use of OTP key generators or similar measures.

This probably sounds like a hassle in the day and age of people just going for the comfort of private github or gitlab repositories, but it's what companies have been doing for almost 20 years as standard practice.

You cannot consider any git repository, even on your own root server, safe to keep private code on. CIOs would argue against that practice for good reason. The same CIOs require work laptops to encrypt all data.

If you don't need to be that serious, then an incident like this should be planned and accounted for as part of using such hosting, and shouldn't be a big deal.
IIRC my employment contract has something along the lines of implying that if a word was accidentally omitted (or added) then the sentence and paragraph is to still retain its original intended meaning (?!)
I don't have any stats, but I imagine lots of users still connect over unencrypted ports directly to their ISP. We have to remember that most users are not like the HackerNews demographics. If you have stats that points to this conclusion being wrong I'm happy to change my mind.
Most government emails are not classified. Outside of a classified context, parenthetical letters have the full take off uses they have in general English communication, especially the use that Clinton suggested was the only one that came to mind in the context of the email in question.

Without any of the indications that should have been present indicating that the email itself was classified, there's little radon to think a stay parenthetical (C) is intended as a portion marker.

Clinton didn't say she didn't know what (C) meant as a portion marker (which would be worthy of mockery) , she said she didn't know that the (C) in an email lacking any indication that it was a classified document was intended to have the special meaning that (C) has within a classified document.
I think it would be more interesting if the radius was variable and dependent upon the population density of your area. This way, your neighborhood in the city (SF) is roughly a kilometer out, but in Wyoming, you're going to talk to a relatively similar number of people. I think anyways it would be more useful for the kinds of tasks I would see myself using this app for.
I haven't gotten to a point where I can compare Clinton and Trump on policy. First I don't think Trump really has consistent or in depth policy on anything. Second, I just don't think Trump has the temperament or stability to be President. I don't know why Trump would be better on foreign wars. But I think foreign policy under a Trump presidency would be based entirely on Trump's personal opinion.

Sure, tweets are inconsequential, and I think politics would be more productive if disagreements focused on policy differences. But his words and actions show that he's a really petty and shallow person. And he would be a petty and shallow President. I don't think he really has many specific well thought out plans he could actually implement.
Need to declutter? Don't bother
That's a good point. It will be on the next version of that comment.
But in front of every compromised IoT device is a compromised router. Whose responsibility is that? I am going to say the majority of users down know how to update the firmware on their routers.

From the experience I have had with customer/technical support reps at cable companies for basic things like a service outage. I can't imagine them dealing with compromised devices and firmware upgrades or locating IoT devices in customer's home. I don't think they have either the staff capacity or sometimes even the technical skill to do so with any efficiency.

Then there's the potential for false positives or bad data where my connection get s null routed and I have to wait on hold for 45 minutes or an hour to talk to someone who may or many not know whats going on. Then I need to prove that there is no IoT device on my local LAN to a support person who might not even know what a mac address is. This just sounds like a mess.
So long as Apple has iOS devs by the short and curlies, they'll have power users to kick in the nuts.
Index cards are pretty cool (2009)
Would it be possible/easy to add the speed of encrypting/decrypting the data as a separate loss function? Potentially this could lead to cryptography being a less expensive computation.
I know this comment got downvotes for being kind of snarky/evoking political debate, but I just thought I'd throw my support out for the main sentiment. It seems like a lot of startups are more marketing rather than technological successes. And I'm not sure I really like that.
I think people are talking new gen XPS here right? Think all of them have supported 4k external @60hz as they have nothing older than broadwell.

I'm sitting here now with a gen1 xps 13 2015 pushing a 4k monitor at 4k 60hz.

My xps 15 in work also supports 4k @60hz although needs an annoying usb-c to displayport dongle.
Aks HN: How did you improve the quality of your code base?
Our company builds a java openGL CAD/CAM application suite for windows
desktops. We have a couple tens of million LOCs, with ~50 projects and
1000s of packages. We grew to ~50 devs. Our teams are distributed worldwide in several locations.
After ~10 years of neglection we need a strategy to increase the code quality (lots of dependencies,
feature envying inheritance hierarchies, spaghetti code, similar problem are solved
in myriad ways, all that jazz).

+ How do you measure code quality? How do you interpret the metrics?

+ What are good tools for a windows/java/eclipse dev environment?

+ How do you act on the metrics and actually improve code quality?

+ Can you recommend any resources of success stories on how companies managed to increase code quality of a big, tangled system?

What we are doing ATM:

- code reviews via Gerrit

- Jenkins for build + testing (~ 5% code coverage, tests run nightly and take ~1h)

- Scrum with 2 week sprints with 30% time allocated for refactor/ writing of tests
+ 1 week maintenance to work on bugs backlog

- small team (2 members) increase GUI tests to automate validation

- developing guide lines for reviews and coding
I don't think this is about inventing a new protocol. It's about getting Gmail and Thunderbird on board. Has anyone put them in a room together?
Wingsuit crash with honest analysis
SG Operations member here:

Funny enough, so do we. We actually use both Vault and Blackbox for building out our BaseAMI, though for different purposes depending upon the nature of what is being encrypted.

One thing I like about Vault is that it allows us to rotate keys without needing to rekey all encrypted secrets. Being able to expire certain secrets - like database credentials - means we can rotate these at will without needing an extra git commit.

I highly recommend using something here, and I commend you for at least encrypting with blackbox :)
Yeah at least my software is fast and lean once it's finally running.
These guys are literally a danger to society at this point.

Just because you think you're "smart" doesn't mean you can make functional foods without serious expertise. Typical case of over-inflated engineer egos.

Obligatory link from 2013: https://blog.priceplow.com/soylent
Show HN: New type of job board for teams and projects gt $50,000
Quite interesting that no one has mentioned the Microsoft Surface Book here. Anybody has any thoughts on it?
The Chinese knockoffs (and Google, for that matter) have trouble making equivalently good software (iOS). It's a challenge in software development and hardware-software integration, not hardware development.
It makes sense when you put it that way. I guess the issue is not so much risk tolerance as cynicism. It is a negotiation where the information asymmetry does not favor me. The potential employer must be offering a variable compensation package with a claimed EV of $X because they believe their actual cost will be less than $X. Otherwise, why make it complicated? They'd just offer $X. I conclude that the only actual knowledge I have about the value of the offer is that it won't be lower than the base salary. I therefore accept the offer if the base salary is high enough to make the job worthwhile, and reject it otherwise. Any additional money which might happen to come along later I treat as a windfall; it has no incentive effect.
Keep in mind for the touch pro haters out there. You can skip the touch bar, save $200, and get a 5kwh larger battery. They didn't cripple it, you can still get more ram, larger ssd, etc.
Why are only passwords hashed?
> I'm sorry, are you from the past?

Isn't everyone?
I don't understand your example. If you abstract away the hard part of searching a database and sending an email (as most programming languages do), then every language is as easy as the snippets you posted. In python:

messages = slack.search()
email.send(to='corey@kodowa.com', subject='hi', body='yo')

Are you saying that Eve removes the difficulty of interfacing with external programming systems? If so, I haven't seen that in their documentation... For one, you still need to know HTML to do anything useful.
I don't agree, people have declared the death of e-mail for many many years now, it's not going anywhere. It's definitely not to late to fix it.
Why can't Apple just make a magnetic USB-C?
Oh? I had read that everything worked ootb. I'm interested in that model for my next machine. Got a link for me aboit the webcam?
Interesting, though I was hoping for a bit more focus on the validation part - unless I'm missing something, there's nothing protecting the actual SQL dumps against bitrot.

I had to design against that particular problem recently, ended up taking a pt-table-checksum at the time-of-dump and verifying newly restored backups against that to ensure the backup's integrity.

Unfortunately that requires halting replication temporarily, so I was hoping to hear of a more ingenious solution.
They state in the post that of 17 million requests to their git-proxy server, only 230 of those requests could be identified as successful responses to incorrect data/repos, at a percent of 0.0013%.

I don't know of anyone that would recommend creating tests, even integration tests, that hammers a service to check to see if something like one hundredths of one percent of requests returns invalid data. If anything, the fact that a script is hammering a service that probably (in a Dev or QA environment) has much less data in it's database and file stores, and much less protection (like load balancing and caching) than it would in production would generate more false positives than it would generate in substantial data disclosure regression defects.
Gore contested his loss. Was that actual subversion of the process?

If the election is close, I think the loser has a duty to contest the loss. Trump contesting the election would be every bit as right as Gore contesting the election.

What is so bad about this? The reaction people are having is strange. It's as if people are purposely misinterpreting Trump's words as implying that he will march on Washington D.C. with a militia. The realistic assumption is a Gore-style lawsuit, and there is nothing wrong with that.
The everything for everyone thing is the cardinal sin with them for me.

If they marketed it as a convenient meal replacement, like a carnation instant breakfast that wasn't a milkshake, it would be different. But they imply that eating food is bad, just drink Soylent.
SG Operations member here:

Yep, thats more or less what we're planning on doing. The documentation released was the result of the initial deploy. We prototyped integration with a few different areas of our infra, and are at the point where we'll be making strategic improvements as we rollout the integration everywhere.

In the interest of being fully transparent, the engineer in charge of the project listed as many issues - small or large - with their initial implementation so we could figure out how to prioritize each one before moving forward.
And if that place that it goes to charge itself happens to have a pile of solar and wind, even better! Way easier to do a bit installation in a less populated area than right in the centre of downtown.
Wasn't sf, still, don't know how she lived.
It doesn't have to be crap if it is modular and upgradeable. Executive controller, hardware controllers, sensors and switches need to be serviceable/upgradeable. The paramount feature(or lack of) would be to keep it air gapped. As soon as you connect it to the net, all is lost & you are now a slave to fees from an SaaS that may be gone in a year, security updates and haxor shenanigans. A truly automated system doesnt require your input after roll-out & dialing. Of course, that does mean no cool app to fiddle with.
That's where the profit margins are...
We've had a couple of VPS provider admin panel compromises, Shellshock and other showstopper remote vulnerabilities for privately administered servers that don't get constant professional attention, etc. It's possible, but not obvious.
So it's post-mined...

Or should we say tax-mined ?!
Do they still have tons of high-DPI bugs where some apps work with it and some get all garbled?
>Most government emails are not classified.

I would guess that a significant percentage of State Department emails to and from the Secretary of State are at least confidential. Again, we won't agree on this until after the election when Clinton supporters like yourself are able to undertake an honest assessment of their new President without Trump in the picture. She lied, she will very likely continue lying, and given the history of the Clinton family, the odds are overwhelmingly high that this will be far from the most significant scandal overshadowing her candidacy/Presidency.
Google’s AI creates its own inhuman encryption
If you can easily de-risk then you should. Of course with most of the bad risks it is impossible to de-risk because nobody know the answer.
Max 100 microsecond stop the world in go 1.8
Rashdanalroomi  -Beads of the Natural Baltic Putty
Title not editorialised at all, uh?
> I also really like Mac OS, even with it's thorns, because its design is much better than whatever version of Linux I would use (not a big fan of Ubuntu's Unity).

I would love to hear your thoughts on the Cinnamon DE. Genuinely curious.
The actual content was in fact made available by a subscriber.
You admit you are not a lawyer, but give and prefer your own opinion on it over that of someone who is a lawyer in the relevant field, and when confronted with the opinion of the lawyer in the relevant field you choose the least charitable explanation of how that lawyer came to give the opinion, in order to continue preferring your view over the lawyer's.

But tech people don't have blind spots or problems when it comes to issues like race, nope, no sir.
Fitting that the link to the Wired story about Asheron's Call 2 in this is pointing to a page on Wired that no longer exists.
I'll look into this more. I'm a simple guy so hopefully my initial forays produce fruit easily. Maybe I'll luck out and there will be a blog post from someone on how to implement this specifically with AWS and Chef.
The law apparently makes it illegal to create an ad which expresses any preference for a specific racial group. I would assume his argument is that by being invisible to a certain racial group, you are expressing a preference against them.
Requirements for a product? Sounds too much like a waterfall.

Have you ever considered establishing product direction through use cases branded as "stories" and pulling them out of your ass every two weeks?

/s
METACADEMY is pretty good: short summaries + prerequisite graph

https://metacademy.org/roadmaps/
It's not unthinkable that a language, by design, facilitates or enforces precise definitions.

As a far-fetched example, think of Lego. You can't "fail to compile" your Lego bricks. You have a finite selection of bricks (all clearly visible and usually available within arm's reach), and your job is to just lay one at a time. Given any brick, it's "obvious" to a human how it fits with other bricks. The worst you can do is essentially create a crappy Lego design. As you noted going from a rough thought of

"Uhm I want to build a Dragon of about this size..."

to a finished build requires a powerful AI. But we don't need to go that far to be better than

"Place $brick1 in p=(32,17) at orientation o=(0,pi); place $brick2 in p=(38,15) at o=(-pi,0); ..."

The rigidity of the bricks inherently prevent you from overlapping them, but not the above declaration :)
FTA:

"The following subscription-only content has been made available to you by an LWN subscriber."

Was that not there 15 minutes ago?
How do you live with the bezel?
People have been selling brands for long before Apple has been around. And the "brand," isn't the logo. It is everything that a particular entity means to you, which includes all customer service, sales, advertising contacts. Which includes selling things as a lifestyle. This is marketing 101.

I'm not going to pretend that Apple did not significantly influence the direction of product design. It absolutely did.

However, you're making it sound like Apple invented product marketing. They didn't. Microsoft and Google are new to the marketing game because they're entering the consumer hardware business, which is a new venture. When you're the defacto software solution (Windows, Google Search), you don't need marketing. You don't need to build a brand. Your brand is so ingrained in culture that everyone, everywhere uses it.

It's a lot better of a spot to be than trying to reach that goal. Google and Microsoft are now going to try to leverage their software platforms to launch hardware in the same way, but it needs marketing.
Asking the right question
Wayuu Backpack: Supporting Colombian Hand Craftsmanship
We initially looked around, and here are a few alternatives:

- Azure Key Vault: https://azure.microsoft.com/en-us/services/key-vault/
- Blackbox: https://github.com/StackExchange/blackbox
- CredStash: https://github.com/fugue/credstash
- Lyft Confydant: https://github.com/lyft/confidant
- Trousseau: https://github.com/oleiade/trousseau
- Sneaker: https://github.com/codahale/sneaker

Some of these didn't exist when we were first investigating proper secret management, while others didn't fit as well with our deployment strategy. We're using what works when it makes sense - Blackbox is used in some repos, for instance - but I'll be sure the next time we have an internal doc like this that we cover why we didn't choose a different set of tools.

One thing we liked about Vault is that it built upon our usage of Consul and the http interface for Vault meant it was simple to plug into how we build and deploy services. While I'm sure some of these other tools would have had as good workflows, our experience in administrating Consul made it easier for us to have confidence in Vault.
This is a rather nice list from Leo, but it seems to be focused on the “lean” model of building a MVP and iterating until you get product-market fit. How do you de-risk opportunities where you can’t build an MVP and you have to invest years in development before you have a product you can show the market?
> You need to install software on your computer. Most e-mail providers are moving to the web, having to install a browser plugin just to send e-mail is not the experience we should strive for. I understand that this is means your e-mail provider can read your e-mail, so it won’t work for everyone. But I think most people will accept that the same way they accept that their bank can read their bank statement. If we can trade this for usability it’s still a HUGE step up for privacy.

Yea we have that, it's called STARTTLS. If the keys arent only held by the user then there really isn't any end-to-end encryption. It's just the same as SSL.
> pay themselves through dividends (which have a much lower tax rate), which is now (highly controversially) illegal

What on earth are you talking about... taking out dividends is not illegal, even for individual company owners. IR35 is about HMRC forcing self employed people to apply payroll taxes as if they were employed. Again, nothing to do with dividends.
This approach was also covered at Black Hat:

https://www.youtube.com/watch?v=dfIoKgw65I0

https://www.blackhat.com/docs/us-15/materials/us-15-Herath-T...
> random early adopters will be getting an "unfair" share

The 'random' early adopters of bitcoin were experienced cryptographers whos investment in bitcoin helped it grow.
I submitted this but am neither the author nor subject. Like many, I've been awed by wingsuit videos (starting with Jeb Corliss several years ago), but this accident analysis is one of the first articles I've found that explains what goes into wingsuit training and ongoing practice. I must admit I've been tempted to try skydiving and learn to BASE jump, but never got started. This shows it is way more difficult and long to learn than I imagined.

It also ties in nicely with the related discussion 2 months ago: "Why are so many BASE jumpers dying?" (https://news.ycombinator.com/item?id=12418937)