skysight-inc/HackerNews huggingface dataset:
I'm quite surprised that these exploits aren't blocked at the browser level by default with developers having to write code to make the exploits work if they need to.

For example, if browsers flatly refused to load code from an external URL unless the address was whitelisted in the page's HTTP response headers then you'd make level 6's exploit impossible without much of an impact on web development.

The CORS header Access-Control-Allow-Origin can be used to force a browser to work that way, but only if a site sets it. I'm suggesting we're at the point now where browsers should be secure by default, even if it breaks some old sites.
That comes from upstream's README.md. I've never payed any attention to it, but now that you've pointed it out, I'm seriously considering changing that paragraph, or adding a note/disclaimer somewhere.

After all these years and promises, server's code is still closed, federation is nowhere to be found, their update/commit policy for the official Android app is a joke [1] (they even closed its issue tracker), and I'm really tired of their "trust us, we're not evil" policy [2].

If you haven't switched to Matrix/Riot, do it right away.

[1] https://github.com/DrKLO/Telegram/commits/master

[2] https://telegram.org/faq#q-who-are-the-people-behind-telegra...
Siobhan from Zenkit here - You nailed it, that's exactly what we mean ;)
The person who wrote this thinks Redhat cannot afford a 500k Linux foundation membership... I don't think that is correct.

They should really step up.
Hacking 27% of the Web via WordPress Auto-Update – Wordfence
that was much less interesting than i thought it would be...
Let's be real though.

This type of thing is targeted towards enterprise and the usual large and well-established environments.

Environments where replacing a 20+ year old app written in COBOL isn't a question.

No one is ever going to say "Let's write this new app in Groovy!". On top of management saying "WTF is Groovy?", it'll never get approved because it's a huge amount of technical risk to take on.

In big enterprise, you want to have your stuff written in the most supportable language you can find resources for. This is why Java is so popular - it's a lot easier to find a Java developer than it is someone who knows Groovy, Rust, Scala, etc.
You can use it for a page that isn't a SPA for example.
I think this is a brilliant move. I've seen people lining up around the block at the sneaker shop near my house for a new release, so I'm sure there is the online equivalent.
Had anyone here recently used stack overflow when not logged in? Last I checked there already were huge, animated banner ads only when logged out, as opposed to more tasteful ads only when logged in. I recall Jeff and Joel discussing this approach long ago on their podcast.

I know this is talking about some of the longer tail sites, but I wonder if that same approach will be taken and which ads will show up.
> At work we use py2 and c++11...

As do most corporations. If you want a job in Python, you had best know 2.7.
Fair point :D we'll look into it asap
Basically the speed and ease of configuration. You're able to set up and clone your whole environment in 15-20 minutes + we put special pressure on shortening the build-test-deploy to minimum: you can create a pipeline that will reflect your Circle-CI workflow and compare how long it takes to finish.
Shopify has been piloting the app with retailers that have the same target market as Restocks (YC W16).

The first pilot was with Kith in October sometime and now they're definitely doing some Black Friday stuff and are launching Yeezys for Off the Hook today.
The pencil story is entirely a made-up parable as well. The author is simply imagining how the pencil industry operates -- he didn't literally trace the steps in the process himself and was a grocery wholesaler in real life, not a pencil manufacturer. If you agree with his political assumptions that the free market is ideal it all sounds very convincing, but that's the problem with any political diatribe.
use.fontawesome.com blocks loading of your website if it's not reachable. Can you move it from <head> to the end of <body>?

And TOS and privacy policy should not require a login ;)
In my experience, a lot of doctors have already drank too much of the Kool-Aid. Of all my family physicians, only one was willing to have candid conversations about drugs. The rest would just shut down the conversation immediately and say all drugs are bad / we're not talking about this.
Looks very nice!

I really would like to see a merge of features between Zenkit and Trello.

If Zenkit keeps my Kanban synchronized with Trello, it's already possible to me use it. I haven't found yet if it has this feature.
PyCharm 2016.3 released with full Python 3.6 support
Battery tech in general is really the limiting factor for environmental improvements of solar and wind over other common forms of energy. We need more advances here, and they shouldn't all come from Elon Musk.

One of the toughest things to overcome is that lithium ion batteries have a limited lifespan (although it's improving) and the cost for that life span compared to alternatives is pretty high, so the economics aren't great. Yet.

The environmental hazards, both in manufacturing and disposal, are not insignificant either[1].

With all that said, li-ion represents our best bet for future tech advances that have minimal environmental impact, especially for space travel.

Eventually. (But if I was a VC, I'd be investing in cleaner and more efficient ways to utilize petrochemicals in the near/mid term.. maybe looking at non-burning tech; whatever happened to fuel cells?)

1. https://en.wikipedia.org/wiki/Lithium-ion_battery#Environmen...
This is important to keep in mind when looking at profiling reports: The cost of cache effects (both I and D!) can be spread throughout the critical path. Even if your profile shows your allocator being executed only in (say) 2% of the samples, if what it's doing during that time is pushing lots of useful instructions or data out of the fastest caches into which they otherwise would fit, the total cost of that allocation is likely much greater, but hard to pinpoint.
This is currently happening with Canadian airline WestJet. For many years they only flew a single aircraft which made maintenance much easier (staff trained on a single aircraft, parts are easier to keep in stock). They since purchased a few larger aircraft to fly to London and Dublin and have been plagued with maintenance issues. Passengers are getting stuck in London while WestJet scrambles to fly in a mechanic and parts to fix the planes.
There was a round of this fought in the US over the "clipper chip" technology in the 90s.

I've been wondering about the interaction of technologies like this with DRM technologies; what if I send HDCP-over-TCP? What if ISIS start using Macrovision on their jihadi videos?
> Unconventional ways of powering your vehicle

The powerful Flintstones lobby would have something to say about that
Hi, awesome tool!

Would be nice if it had localization support so I can use it with my non-english speaking colleagues.
Depends on the strain. Some strains affect healthy adults worse than the sick. A fit 20 year old can have worse time than a sickly child or elderly person.

Look up cytokines storms. https://en.m.wikipedia.org/wiki/Cytokine_storm

A strong immune system can be a liability. When I was nearly hospitalized with the flu, I was in my late twenties and in the best shape of my life. Which is why I must repeat myself, DO NOT FUCK WITH THE FLU.
Reg man 0: Japanese electronic toilet 1
HackMyFortress – Black Friday – 20 000$ REWARD
Thanks so much for your suggestions. We have plans for freemium pricing & will probably start charging in the Q1 of 2017. Pricing will be in the range of other productivity tools in the market.
Same experience here.. I come from a family of doctors, and not a single one of them is particularly against the war on drugs it's quite the opposite. This even seems to trickle down to nurses and it's probably as someone else described because they are biased from having to deal with all situations where something goes wrong. Of course you will find the occasional morphine junkie doctor but it's probably not even interesting to them either since they have all the drugs they need available.
Voter suppression does not mean people at polling stations with guns threatening people (though that does occasionally happen). Voter suppression includes lessening the number of voting precincts to depress minority turnout and create longer lines. Purging voter rolls illegally. Voter ID laws that target the poor. Reducing the number of days where early voting takes place.

I don't think these are particularly bold things to claim are happening.
Thanks Ed, I guarantee it won't take long to reproduce your workflow with Buddy's pipelines. As for the documentation, you can find it here: https://buddy.works/help
Ghost in the Machine Learning: Recommender Systems
I enjoy reading things that have more time and intellectual energy put into them.

This is not true of a lot of twitter ... but the short constraint I think is the only thing that really moves the needle in that direction on there.
I've been pretty happy using diceware[0] for my word-based passwords. Just be sure to use actual dice and not a software based random number generator if you want it to be truly random.

[0]http://world.std.com/~reinhold/diceware.html
When GitLab upgrades PostgreSQL, it will require a manual step (typing a command through the `gitlab-ctl`) as it involves downtime and can take quite some time depending on how big the database is.
Telegram has flaws, but please stop this "Russian backdoors" FUD. They even have this in the FAQ:

"While the Durov brothers were born in Russia, as were some of the key developers, Telegram is not connected to Russia – legally or physically. Telegram's HQ is in Berlin."

https://telegram.org/faq#q-who-are-the-people-behind-telegra...

Also,

"Since being dismissed as CEO of VK in 2014,[7] the Durov brothers have traveled the world in self-imposed exile[8] as citizens of Saint Kitts and Nevis.

[...]

Durov is a self-described libertarian and vegetarian.[27] In 2012, he published manifestos described by commentators as "anarcho-capitalist" detailing his ideas on improving Russia[28]"

https://en.wikipedia.org/wiki/Pavel_Durov
Environment and Climate Change Canada's recruitment page:
https://www.ec.gc.ca/emplois-jobs/
I'm sure they will, but it's too easily answerable - open source browsers without the back doors will be trivial for end users to build. So again, it'll come back to criminalising what end users do, because in the end only restrictions on the end user can stop them using their own resources to build things.
> Guess my job is safe for at least my working-life.

No kidding. I thought the receptionist that had to ask for help every time she needed to attach a file was the exception, but it looks like she's actually the rule. And that was 10 years ago. Damn.
What are the alternatives to SMS two factor authentication? Software like Authy? Even if it's easy to get around SMS wouldn't utilities like Authy also have vulnerabilities, or is the idea that at least they can be patched?
Also, I have some feature requests. I should mention I'm already a fan of the product and will be trying it out for the next few weeks, and I'm also sure you're already developing some of these.

* Mega List View: Collections are great! But sometimes I like to see all the things and feel overwhelmed. I can do this in search for tags (search "in progress") but a combined collection list would be cool.

* Data Export: Sometimes I want to export my list, like if I'm traveling without internet for a week but would like to still work on things. A .CSV, .MD, or something text based would be nice.

* Webhooks: I'd like to post to a slack channel when a task is done

* Assignment of tasks (not collections): I have a collection with a lot of tasks, but want to assign a specific task to an employee without them seeing all the collection tasks. Perhaps an 'assigned to me' board? Or maybe I can link a task to a different collection?
Bitcoiners too, it should be noted.
You donate by contributing content to their sites. How (or if) they monetize this is up to them.

As a user, I feel obliged to help others out and I make an extra effort to answer some questions when I ask one, or when I find a particularly useful answer that helps me with anything work related. This adds value to the site and again, how they monetize is up to them.
Actually Cellebrite themselves have been victim of some kind of hack last month and had a load of their internal documents leaked online. So no, if any, this firm is _not_ the right hands.
Primative.js – JavaScript port of Primitive.lol
2.7 does Unicode quite well. Not as well as it should, certainly, but arguably better than 3.3 did. I haven't played with anything since, and given the long history of this project going off the rails, I will require some serious convincing before I waste more time in it.

Yes I do multilingual string processing a LOT. I worked in SMT for about 3 years. Python 2.7 was the only practical option.

Python 3 does not fix the GIL. That would be enough to get me interested again.
Which is why the measure used for criminal law is beyond reasonable doubt: if there is no other evidence than an historic visit to a domain that the police can't show contained criminal content then there's not going to be a conviction (indeed the CPS wouldn't even entertain carrying such a case). If on looking at your hard drive the police then find a cache of content supporting criminal activity you're certainly going to have a hard time if you're innocent.

Do you know of any UK caselaw covering situations where people were convicted on the basis of having visited a particular domain and no corroborating evidence was found? Would be interested in reading how that went down.
10 Times More Galaxies Than Previously Thought
The likelihood that Facebook or any other corporation cares about public good more than its own and its shareholders' bottom line is ludicrous. I'm not commenting on whether that's right. I'm saying that's how the system is built to work.
I don't believe enough people would care enough about it to start a civil war. I think what needs to happen is, instead of going into IT management at 40, where we do more harm than good anyway, we start running for office until the government is full of experienced tech people.
This is flagged as a [dupe]; it would be useful to have automated links to the previous discussion in HN, maybe in the [dupe] tag.

I'll now go search for the previous discussion. The "past" link does not yield any results, and even searching for the TC URL does not find it.
please use https://ideagist.com
"NPS is a proven methodology"

That's a blank statement that tries to be authoritative and sounds nice, but where's the proof?
Jesus Christ. I tried to be polite but I'll just outright say it: Don't be a dick. You are falling into the trap of "You aren't pure enough for me so you are evil" that is so common.

And you are once again picking a single metric to compare against (seriously, read the other branch where there is a great discussion that breaks things down a lot better with respect to an island off the coast of Scotland).

Price per kilowatt-hr is one metric that is worth considering. So is kw-hr per square mile, installation costs, maintenance costs, and many others. Not to mention that a lot of those metrics assume optimal conditions which might only exist for a portion of a given day (or year...). The reason why filthy sources (oil and coal) and comparatively clean (nuclear) energy are used is that they are consistent. It doesn't matter if it is a bright summer day, a cold and windy night, or just a dreary morning: They make the same amount of energy per unit resource (mostly. There are actually a lot of caveats).

But, as mentioned, they are a lot harder to fine tune. And they result in a dependence on expensive resources and are bad for the environment (nuclear isn't AS bad, but it is still pretty crap). That is where clean sources like wind and solar come into play for the vast majority of the planet. We can drastically lower our dependence on dirty sources by using clean sources to supplement and wean us off of dirty energy.

But I guess I am not ideologically pure enough for you (or, at least, the small snippets of my posts aren't).
Politics. There is a compile-time flag in firefox that allows it to use system codecs (for images as well as video). I ran a self-built Firefox for some time that had this enabled. Mainly to view media files on the local network, and because there was a time where people were putting up some files that chrome could open, but not firefox (I forgot what that format was - maybe it was even webp).

If you enable the flag (or, disable the built-in whitelist), then Firefox uses GStreamer (and I believe DirectShow on Windows or Quartz on macOS, but I'm not sure) to display the videos.

There also used to be the option of using MPlayer as a plugin, but NPAPI support was unfortunately removed.
Ha, makes sense... I didn't really take any offense.
It's a discussion of the google blog post linked in the techcrunch article (which arguably just reports on that article, and thus maybe shouldn't have been submitted): https://news.ycombinator.com/item?id=13018201
That was much more sane and reasonable than I thought it would be. Two sides of the same coin.
SEO Check Online – about.me
We've got dedicated build actions for Java, .NET/.NET Core and Python that you can use to build and test your app. What do you mean by Windows Docker containers exactly?
When I actively pursued 'being informed' I read the dead tree version of The Economist cover to cover every week. It's a significant commitment of time and a non-trivial commitment of money but the payoff was worth it so long as I had that sort of goal.

Good luck.
You can use www.ideagist.com
>mandating that ISPs track all internet activity //

Isn't it 'just' domains visited? I don't know if that's web or internet or what though.
Scala work sure pays a heck of a lot better.
Of all services mentioned here, this is the one I like the most and the one I think I'll use.

Their pay as you go makes totally sense when you have a static website that will be access sporadically and you don't want to rely in a public infrastructure such as Github.

I also don't want to depend on freemium services, because they could just shut down the free tier any time.
It isn't on by default for backward compatibility, but such whitelisting is possible today with https://developer.mozilla.org/en-US/docs/Web/Security/CSP
Pros and Cons of These 6 Remote Work Setups
Does Facebook have any binding commitment to not be an asshole with patents? (The patent license on things like React.js surely isn't)
>Protect their children? Has there been any study that children need this "protection" you speak of?
I was able to get hold on porn videos when I was a teenager, despite not having internet at home or somewhere else.
At the end, the only way forward is to speak with your children, it has nothing to do with firewalls.

I was referring to this part of the article:

>The government said its new rules were based on studies that suggest viewing pornography at a young age can have detrimental effects on future adult relationships.
A survey from the NSPCC found that nearly half of 11-16-year-olds had accessed an adult site and one in five 11-17-year-olds said that they had seen images that had shocked or upset them.

The reality is that even younger children are now regularly accessing the internet and they are able to access pornographic content by accident. When it comes to young children, what exactly are you expecting parents to talk to them about? These are children who haven't reached the age where they have had any education regarding sexual activity, but they can still use an iPad or a laptop. Here is a classic example of inappropriate advertising in a children's iOS application: http://www.independent.co.uk/news/media/advertising/explicit...

As a parent of young children I do want to be able to restrict their access to the certain parts of the internet, in exactly the same way that I wouldn't let them watch an age-inappropriate movie. It's an entirely different scenario to you as a teenager seeking out pornographic videos.

The point is that young children can stumble into a "virtual sex shop" or a "virtual strip club", whilst in real life they can't - they are barred from entry.
> whatever happened to fuel cells?

Toyota is actually coming out with a hydrogen fuel cell car: https://ssl.toyota.com/mirai/
The introductory presentation (linked from the article) suggests what should be logged:

- customer ID

- start and end times of the 'event'

- source IP address and port (the port is used to avoid a NAT at the ISP level)

- destination IP address and port

- volume of data transferred in each direction

- name of internet service connected to

- the URL

https://www.gov.uk/government/uploads/system/uploads/attachm...

There is a sample provided on the next page, which dumbs it down enough so that it sounds rather compelling.
Some food for thought:

JSON format+JSON.parse() make you loose the graph structure of the data you have on your server and that you send to the client.
Because it is basically a tree structure.

The Semantic Web defines a graph description langage called N3.
If your server can serialize and send the data in such a format, and if you use the function N3.parse() on your client, you eventually retrieve, on the client, a graph of in-memory objects that corresponds to the data graph on your server. You can then traverse that graph in any direction you want.

So basically, with N3, you never lose the graph structure of your data.

And you do not need to restructure your JSON.
This is why I always dress like Flavor Flav.
In case someone user Meteor - Vue plays very nice with Meteor and there exists a great integration package [1], which means if you're familiar with Meteor you can write full stack applications with it very easily and quickly with it. The package supports hot module replacement out-of-the-box. It's also dead simple to start using it, if you already have Meteor installed it's a matter of running "npm install" and "meteor".

[1] https://github.com/Akryum/meteor-vue-component
Isn't that risky? The subscriber number will sooner or later be recycled for another device (in the case of burner phones) or customer (in the case of voip). They could in turn disrupt your Signal use.
You can use JSX to write your render functions in Vue [0]. It's opt-in as the Vue community views them as overkill in the usual case.

Personally, I appreciate having the intuitive approach for templating as the default for people who don't share my encyclopedic knowledge of web development. They can more easily follow along and contribute.

[0] https://vuejs.org/v2/guide/render-function#JSX
The New Google Sites
Live Webinar Ongoing: Creating a ToDo App with React Native and NativeBase
How Imzy Plans to Fight Online Trolls
Blinkist 15-minute Book Summary App Review (v4.0, screenshots of all features)
+1 for Github Pages + Cloudflare

Wish there was a poll option on HN. How are you going to count OP? Will you share the results?
The readme is more up-to-date than GitHub pages. It answers some of the questions in the comments. https://github.com/bazaarvoice/jolt
Ask HN: After I build a prototype, how do I get feedback to 'iterate quickly'?
I have been working on a side project www.schesign.com and have been getting feedback from friends and coworkers, but now I'm ready to get feedback from more people. But my post didn't make it to the front page of HackerNews so it when on and off the new section. Maybe I should be trying to cold email different companies that could be interested? Or maybe make use of Twitter? I've always read about quick iterations and getting feedback quickly, but how do you actually get the feedback for an early stage prototype/product?