skysight-inc/HackerNews huggingface dataset:
> Has anyone here encountered an actual breaking change?

The fact that if your local client is newer than the daemon, the client will fail to do anything is pretty annoying. You can hack around it, but that's not a solution to the problem.

Also, while you shake off the 1.10 change as though it wasn't a huge deal, the migration tool that was written was not fit for purpose. First of all, it sometimes caused corruption after the migration (fixed after release but still an issue, and you couldn't practically un-bork the corruption). There were other issues with the tool, but the biggest issue was the there wasn't any sane transition period -- which made packaging very difficult. Because Docker couldn't handle restarting the daemon and keeping the containers around (and after restarting a post-1.10 daemon you'd have to wait for the full migration to finish before you could even interact with the daemon -- another issue with the transition), you'd have to publish a fake version bump of the Docker package to even alert users to the issue!

A more sane way to handle it would've been how databases handle the issue. You lazily do the conversion (or you have your software be able to handle both formats so you can run your migration while still having your containers work). And yes, I'm aware that it'd be difficult to implement but the transition path implemented was really bad.

I spent several weeks of my life (that I'll never get back) trying to make the migration path work. It didn't end up working because it wasn't designed to work nicely from the outset. So I ended up just telling users of our Docker packages about the issue and packaging the migration tool separately.

Another issue that I've had recently is that Docker is making it increasingly difficult to use `runc` by another name. In openSUSE we package a system runC separately to Docker (and it lives in /usr/sbin/runc), but because of the fact that in 1.12 --runtime was intentionally broken (and containerd's defaults are no longer obeyed by Docker) now you can't effectively use --exec-opt native.cgroupdriver=systemd. Great. So now we're going to have to package docker-runc and docker-containerd separately.

Don't get me started on the containerd split. I was not very happy the day that PR was merged, because it caused a bunch of headaches for us. It's also a bit amusing to note that containerd was tagged as "pre-alpha" until Docker bundled it (then it was considered stable).

That all being said, Docker is a great project -- it's just that you have to admit that issues with Docker are not "incredibly disconnected from reality".
How come?

$ go build -buildmode=c-shared

If you mean Go plugins, there is a proposal, anyone is free to implement it and do a PR.

Or then just wait until it gets eventually implemented by the core team.
> Pass doesn't solve the most important issue: passwords available on all devices, most importantly mobile.

https://github.com/zeapo/Android-Password-Store

https://github.com/davidjb/pass-ios
In countries that have mandatory military service, many men create lifelong friendships in there. A great thing about it is that you meet people from literally all walks of life, the lowlives, the poor, the politically connected etc, all in a neutral environment.
> Php code that isn't as insecure as an ugly girl on prom night

What the hell? Where did this come from? Could you not think of a less sexist metaphor to use here?

Maybe this is how you talk to your buddies, and maybe that's fine, and maybe it's even ok to speak like this here, but in the interests of not making the tech industry even more hostile to women than it is now, my request would be to refrain from picking this particular metaphor in this particular forum.
I found this article confusing:

>There are three main differences between man-made reservoirs and lakes:

>1. Man-made reservoirs require flooding terrestrial land, supplying a large pulse of dead organic matter from trees and grasslands. The timescale of how this happens to natural lakes is much longer.

>2. Man-made reservoirs experience greater fluctuations than natural lakes. As reservoirs reduce in volume, the weight of the water over the sediments drop freeing even more methane molecules from the confines of their origin.

>3. Man-made reservoirs are often closer to human activities, such as agricultural run-off containing fertilizers that can promote the growth of organic matter in the water.

Here one-off effects are mixed with ongoing effects which makes limited sense. Also agricultural run-off is mixed in. But if that is not producing methane in the reservoir then in will be producing methane elsewhere - cause and effect is mixed up. Then later on the alternative:

> Groundwater recharge basins are regularly maintained to have less organic matter at the bottom, since it can clog the percolation of water into groundwater aquifers beneath. In addition, recharge basins are shallower than man-made reservoirs and periodically become empty during dry periods when less water is available to recharge groundwater.

I'm confused about a shallower basin being less problematic as the methane is produced by the wet sediment. A shallower basin for the same amount of hydro power would be much larger.

What is miss is putting the generated methane in relationship with the generated energy.
AI, "The Boogeyman" man of our time.
There are alternatives with comparable or better security, but they tend to have other flaws. Most of the alternatives including Wire and Riot ALSO depend on GCM, otherwise they either lack push or force ridiculously bad battery life. They also have bad UX since they don't ask the user for a battery optimization exception permission, so the user would have to somehow know it's required or they'll break after a while in the background.

Conversations / OMEMO is a great Android messaging client, but it's ONLY available for Android and a desktop client (Gajim OMEMO plugin). It can use OTR (which it marks as less secure) but there isn't even a decent iOS OTR client anyway. ChatSecure iOS will probably get OMEMO and push support along with becoming a more decent client but it's going slowly. Until that happens, Conversations is problematic because there isn't a decent way to talk to iOS users.
> Two hundred years earlier [...]; in the mid-nineteenth century they became show-business celebrities.

As Chesterton wisely almost said "When people stop believing in God, they don't believe in nothing, they believe in anything." ( http://www.chesterton.org/ceases-to-worship/ )
I have much faith in Dropbox' security so I use 1password (uses Dropbox for online storage). It even works on Linux with Wine and Chrome. (except for auto-submit, but I don't use that feature anyway.)
Not sure about elsewhere, but in Canada, any candidate on the ballot is usually allowed to appoint up to two agents or scrutineers per ballot box, usually to spell each other off (it can be a very long day)
Why does this article talk about cow burps in connection with methane? Surely that's cow farts? Or do cows somehow produce methane while cud chewing?
They reflect poorly on the Lastpass website , not necessarily on their crypto.

Judging from the URLs, it seems that each action is handled by a different standalone script. This is very common in legacy code bases, and it typically (not always) means that:

1) all those scripts need the same bootstrapping boilerplate copy-pasted into them, which is a maintenance nightmare. Even if you simplify it to one or two lines of boilerplate that includes a central boostrap file (or use some configuration magic to automatically run an additional script before the script you requested), it's still worse than having a single centralized entry point that handles routing, auth, and so on. There's always a chance that someone forgets or botches an auth check in one of these files and it goes unnoticed.

2) you will probably be able to make an HTTP request directly to some file that was not intended as an entry point (the author mentions header.php – this is a perfect example), and then who knows what happens, because you never planned for this and your bootstrap code doesn't run and possibly variables expected by that script are not defined, or errors thrown by the script are not handled by a pretty error handler... kinda like doing an assembler jmp into the middle of another function, after any sanity checks it might have had.

3) I have been working with PHP for 8 years now, and almost inevitably, where this pattern shows up, there's most likely outdated and insecure practices like SQL queries from string concatenation (leading to SQL injection) or unescaped HTML output (leading to XSS, XSRF, or other security problems). It's basically an "easy target" sign for hackers.

Front Controller pattern [1] is a recommended alternative.

[1] https://en.wikipedia.org/wiki/Front_controller
never sign those ones.
Yep, San Francisco also has two trams from Melbourne, Australia:

http://www.streetcar.org/second_melbourne_tram_joins_f-line-...
Alex, Tibet and Didier quit their jobs to cross South America on dirt bikes
Not to mention the lengths companies go to to make sure your whole social life is with people you work with.
> I invite those who have opinions about Signal to start by getting involved in the project.

Yeah we've been there. Do you remember someone on Github complaining about the Google dependency? You closed that issue as a wontfix. Or LibreSignal? I read the post where you basically told them to go away on Github too.

That's why I haven't recommended Signal ever since trying it myself a year or two ago.
ARTFINDER:+“Time+stays+long+enough+for+those+who+use+it.”+
The public out cry is because Apple removed the ESC key for no reason (and positioned it one row above on the touch bar). And many are angry that MacBookPro now costs even more, and has 2013-style hardware in 2016. If it was called MacBookAir and cost half there would be no out cry. A Pro-level notebook that is now way too thin for high-end hardware and too thin for common connectors and too slow for high end application needs like 4k video cutting & processing, etc. - well it's not a Pro-notebook anymore, more something for wannabes, life-style and hipsters article. As the other hardware desktop/mini/Pro/notebook stuff from Apple is stuck in 2013-models as well, it's scary to watch how they don't get it at all. So the touch bar isn't a problem, it's just one of many questionable decisions (the same happens at Microsoft, so many questionable decisions and deaf ear to the community) - Steve Jobs and Bill Gates are really missing.
What languages that are reasonably common for web development would you consider to be "secure by design"?
Ask HN: Should I open source PropertyWebBuilder?
I've spent most of the last year working on an online website builder for real estate agents. In the end I found it quite hard to market and I'm not making any money from it.

At this point I'm tempted to give up on it but I hate knowing that all my hard work will go to waste. Right now I would need to spend another month or so cleaning up the code etc to be able to open source it.

Is there any way I can justify the extra effort and cost in open sourcing it? Is there a chance I can get some organisation to sponsor it? I would appreciate any advice about the open sourcing process, what risks I should watch out for etc.
13' ones use U (ultra-low power) processors, while 15' use QH (quad-core with high performance graphics). Same with Dell updating XPS 13 with Kaby Lake last month, but XPS 15 would have to wait till next year.

http://www.everymac.com/systems/by_processor/intel-core-i7-m...

https://superuser.com/questions/940168/meaning-of-intel-proc...
You can't.

The DB is encrypted locally using your password (wich lastpass does not have because they store only the hash)
Hm, let me think:

* Get the AWS sysops associate certificate
* Run at least 60km (I know it's not much - but it's okay for me)
You tell a story very well :-)
Best Viral Motivational Video
> 3) where there's legacy, there's most likely outdated practices like SQL queries from string concatenation or unescaped HTML output.

If you combine the article's findings with this observation, one could foresee sending a crafted /footer.php?args=SQL+Injection+goes+here type request that skips past where input is "sanitized" and results in code injection.

(Further details are NDA'd, but I've found similar issues before in production systems.)
It's not easy, candidates have the right to appoint agents to verify the voting process, the ballot counts, the correctness of the markings and to certify the count and confirm the ballots are properly sealed in case of a judicial recount.
Can't work on my own apps recommender system atm, so taking part in the latest Kaggle competition from Santander instead.
With an Open Heart and a Bottle of Bacardi: The Best Onboarding Kits
> Besides providing the reference, was there something you intended to convey with the quote?

Only that Touchbar seems intended to be very dynamic and have constantly changing mappings. So there will not be much consistency across apps, especially since common shortcuts shouldn't be put there.

This is very different from a keyboard.
Surely just about any IDE can do this, without having to upload source code to some random website?
I'd stay away from it, it's super competitive (I've tried a lot of things). The only thing that I can think of is VR porn - it might not be so crowded yet.
Microsoft Teams: The opposite of Slack
> But if that is not producing methane in the reservoir then in will be producing methane elsewhere

Not necessarily. The article explains methane production as so:

[...] bacteria eating this dead organic matter to depend on other molecules containing oxygen. These include nitrate, phosphate, sulfate, and carbon dioxide. The least appealing molecule to breathe for these microbes is carbon dioxide because it requires the greatest energy to break the molecule apart to access the oxygen. When these microbes have no choice than to breathe carbon dioxide, a process called “methanogenesis” occurs.
This seems similar to what is used internally at AppSpotr[1] (disclaimer: I'm a former employee). They also use JSON to represent apps that can be rendered in iOS/Android clients. The difference is that apps must be built using a WYSIWYG editor rather than by editing the JSON directly.

From my experience, a JSON representation works very well for a big percentage of all the apps out there, and you can often do without custom code. Good job creating this open-source version, it looks very expressive and useful!

[1] https://www.appspotr.com/
But nothing theoretically stop them from getting your master password.

You have to put a lot of faith in them and the question why would you always remains.
Ask HN: Do you do QA before releasing a mobile app?
If so:

1. Is there a special employee to do that?

2. What software is being involved?

3. How do you structure the tests? [checklist | scenario descriptions | other (what?)]

4. How do you give feedback to devs? (reports?)

5. When is the QA being done? [before beta dist | before public release]

6. Is it helpful?

7. Are you happy with your workflow? Any comments how to improve?

thanks!
I believe Symfony's standard existed before the PHP-FIG which made the PSRs.
That's not a problem with LastPass, it's a problem with password managers - also coincidentally a feature of them.
The conclusion is broadly correct. There _is_ a lot of money to be made in asteroid mining. The reasoning is completely ridiculous. Imagine giving everyone on the planet a 1000kg ball of gold. It would make it pointless to trade and be a pain to have around, You'd pay people to take it away and dump it.

Asteroid mining _will_ be a massive provider of resources in the future. Industries that use those resources will pay for them. I imagine some truly awesomely huge structures will be manufactured in space in the further future with the vast resources available.

There will be an interesting adjustment to the valuation of metals once the industry develops. The metals most used will drop to around the cost of collecting them (plus some profit for the miners). Metals that have less use than their relative abundance within the asteroids being mined are effectively a waste product where supply would exceed demand. Gold is probably in that category. It's useful for things, but not _that_ useful.

So I wouldn't invest in Gold long term. That might be quite a long term though.
Dear Natural History Museum, What Is That Infernal Squawk Out My Window?
Effective Developers Communication
Just a heads up comments like these don't really say anything useful. I know you're splitting keys because that's what the function is called. What the keys are or why they're being split is what the comment should mention.

// Split our keys
list($encKey, $authKey) = self::splitKeys($secretKey, $salt, $config);

Also what's happening here? This could do with a comment for more junior devs. It's impossible to Google "function with a colon on the end of it in php"

public static function decrypt( [..] ): HiddenString { [..] }

Edit: Re-phrased my wording to be a bit less boorish
Write it down, store half of it in a safe, the other half in a compartment in your purse/wallet (which you keep on your person).
It's actually not quite that bad, but there are some areas where men outnumber women by over 40% [0]. The ratio is a little better in Silicon Valley, at about 1.14:1 [1]. The SF/Oakland/Hayward metro area fares a little better at 0.93:1 overall [2], but that doesn't take into account how difficult is is to access SF from the East Bay and vice versa. It doesn't take much of a skew to really mess up the ratios.

[0]: http://visualizing.nyc/bay-area-zip-codes-singles-map/

[1]: http://blog.sfgate.com/stew/2014/10/02/study-says-silicon-va...

[2]: Ibid.
its lifetime
> Melb, Australia, because it's the most livable city in the world

Are you joking? It must be one of the cities in the world with the worst traffic. And of course, real estate is so cheap...
> Just a heads up comments like these don't really say anything useful.

Thanks for looking through the code. I'll make the comments more meaningful on my next run through.

>
Also what's happening here? This could do with a comment for more junior devs. It's impossible to Google "function with a colon on the end of it in php"

That's a PHP 7 feature called return type declarations. If it doesn't return an instance of HiddenString, PHP will throw a TypeError.
I've been using this on the desktop, and Password Store + OpenKeychain on Android, both are very polished apps. This setup works great with a YubiKey.

https://fossdroid.com/a/openkeychain.html
https://fossdroid.com/a/password-store.html
> Not particularly. It's using the wrong tool for the job. A distributed database is helpful in many ways, but you don't need an attached proof-of-work system.

Blockchain doesn't imply PoW. You could consider each block minted with e.g. a M of N signature scheme, in the case of a stock-trading system you don't need open anonymous/participation and it's quite fine to rely on trusted parties.
The code is already written and both the signal server and clients support federation. It's not enabled in O
Newage rhymes with Sewage.
So this seems to be more about the retention of data than it is about the collection. Where the retention of all data is not as important as a select few that pertain to national security. I'd love to play devils advocate here and claim that the agency requires all the information or court oversight of a spy agency is ludicrous. But I dont think any one branch should be judge jury and executionor. I wonder how much of this is symbolic? I know here in the US we are lucky to even hear about a segment of what happens. But I can certainly argue that many questionable deeds are done in the interest of the american citizens
The original trains from the Docklands Light Railway in London are now in Essen: https://en.wikipedia.org/wiki/Docklands_Light_Railway_rollin...

Canada has carriages originally intended to run overnight services through the Channel Tunnel: https://en.wikipedia.org/wiki/Nightstar_(train)#Via_Rail_Can...
Oh no I mean if we shrink it down to the PHP it becomes public static function decrypt(): HiddenString { }

The way I worded it is implying I'm digging at you sorry. I mean the literal what does this do, I've not come across formatting things like this before
Here is the site where I offer the service:

http://propertywebbuilder.com/welcome

And here is an example of a site built with PropertyWebBuilder:

http://re-renting.com/home
Sounds like state-of-the-art pre-adblock technology.

Browsing with no-JS/JS browsers indeed is laborious nowadays. I use this approach out of habit on my desktop machine, but on my new laptop I just couldn't bring myself to copy this solution and installed an adblocker instead.
Until recently, Buenos Aires' A line still used original rolling stock from the 1910's. https://en.wikipedia.org/wiki/Buenos_Aires_Underground#Natio...

(photo: https://upload.wikimedia.org/wikipedia/commons/d/d4/Coche_La... )
I have edited your reply into the article with credit. I hope you don't mind otherwise I'll remove it.
You really shouldn't have to show credentials. If tpateck had cared, he could easily have looked them up. And besides, arguments should stand on their own without credentials. Our hacker space recently defined a hacker ethos: one of the first things was that credentials or certificates or something don't matter.
Wow, what an non-argument. I expected some kind of security analysis. Not a "look at them using file extensions" rant which doesn't say anything about the quality of their software at all.

How got this submission to 30 points? Voting ring?
You're fine, I just didn't understand your question on the first pass.

EDIT: https://github.com/paragonie/halite/compare/v3.1.1...3b95d85...
The way I understood the proof of work system is that it's there to determine which block is accepted as truth. So during a conflict, the first to solve the proof of work puzzle has their block accepted.

For distributed databases, when there are multiple conflicting transactions that touch the same data, I could see the proof of work as a method to determine which transactions win, especially in a global, multi-master model. When the proof of work puzzle is solved during conflicts, the transaction is accepted as truth and moves to a COMMITTED state. It seems kind of wasteful if you are paying for resources to solve challenges, but maybe there's a better way to decide who wins for trusted vs untrusted environments.

As an aside, Spanner I think acquires locks globally before writing. Maybe there's an interesting global-lock free model that just works using block chain, even if it's just for trusted parties (I.e. Google-internal).
Thank you for this! I have no experience with PHP (old or new) so I was mildly puzzled by the article. The two concerns raised seemed to be "their app layout is old school" and "they're not rewriting to pretty URLs" which both didn't really seem to justify the "avoid lastpass" title.
I keep it sync on a virtual Server with sftp, where i Upload the db, sshfs to Mount it - the Directory which contains the Database, localy on Linux, or easySSHFS on Android.

To Set this up i need for every new device around... 10 minutes

It isn't THAT hard. Im pretty sure there is a dropbox(or $urCloudProvider) App that Can sync your files too :-)
Where I live, the ballots we use are cut into one piece per question. Then the pieces are counted separately.

There was a court argument over the use of scales by some municipalities. The scales are used to weigh piles of votes to determine vote count. So ballots with multiple question are cut, sorted, then weighed. I'm looking into lead pens to give my vote more weight :-)
I've been using Enpass[1] for a while now and it's great. Free desktop clients (Windows, macOS and Linux), and $10 for the mobile app. Supports a bunch of cloud services for sync.

[1] https://www.enpass.io/