skysight-inc/HackerNews huggingface dataset:
It's more that there's more then 1B accounts out there - remember that this isn't just "yahoo.com" that got affected, it's Yahoo, YMail, RocketMail, yahoo.co.jp (a HUGE community btw), and several others which all fall under the "Yahoo accounts" umbrella. Not every account was hacked by any means; terrifyingly, the number of accounts isn't nearly what you'd expect as a percentage of "Yahoo accounts".
Recently moved to this from webpack 1 for both personal projects and work. Webpack 2 combined with Yarn running inside of Docker to automate builds is the nicest (and fastest) frontend build pipeline I've had yet.

The experience with Webpack2 is so much better:

- Cleaner documentation

- Saner configuration files:

- It errors out if you add incorrect flags!

- This means that postcss et. al. use config files

- Saner module definitions (now called rules):

- No query flags!

- Actual object support!

Plus tree shaking, code splitting etc. It's way better. Now looking forward to integrating babili within webpack to remove uglify.

If you're thinking of upgrading it's not that much effort given the new documentation, too. Definitely worthwhile, and there seems to be less occasional build bugs using this with newer babel plugins (originally switched because of a crazy stackoverflow parsing a two-deep object).
> As mentioned, a "satellite camera" that transmitted all pictures somewhere else and stored nothing is a much more worthwhile goal.

you can do this right now with inmarsat BGAN streaming, but are you prepared to pay between $5 to $20 per megabyte? that can add up quick.
Ah, interesting. I hadn't gleamed that from the threads. It's great to hear that there's a chance that this will be supported though!
I get your point. It is very appealing. I do note that HTML is a definitive example where the strict version lost. Hard.

My argument here would be to do your best to not create ambiguity in what can be fed to you. The currency one is a great example. Never ever make something that takes in untagged integers as a value. It could mean too many things and you would have no method of knowing what was intended. But, once you start accepting strings, "$4" or "4 dollars", or "Four dollars" should all be on the table. (Though, yes, in this case probably best to stick with "4 USD" and complain about "dollars" being ambiguous without another qualifier.)
Care to explain? The hashes are what is compared so it seems it's important.
nelson_ha_ha.gif
Isn't just better to enable autosave? (VS Code has that as well). I learned its usefulness from PHPStorm, where it is switched on by default. So I just not explicitly save anymore, it is done automatically and immediately.
My preferred method:

Add an "expires" field to the token, this should contain a date after which the token is no longer valid. Now all token s auto-invalidate after a certain period.

Allow some or all tokens to "refresh" by calling a particular endpoint (call with valid token and get a token with expiry from now).

Optionally add some form of identifier to the token (user_id works great) so that you can push a message out to your servers that looks like this: "All tokens for x expiring before y are invalid". Once time y has passed your server can forget about the message. This will be a very small set (often 0) as very few people use the "log out my devices" features.

Logouts should be done client side by deleting the token.

If you are worried about your token being sniffed you are either not using HTTPS, or sticking it somewhere stupid.
Apollo GraphQL Client Chrome Dev Tools
Disappointed to see that this got flagged/buried -- I thought the no-politics ban was for only a week? Anyway, this doesn't have to devolve into a political debate, or at least Trump-bashing. Because the RNC was correct, if what's detailed in this post by the Trump ad-designer matches reality: https://medium.com/@garycoby/twitter-restricts-trump-eb7e48c...

The choosing of emoji is inevitably political -- how could it not be? But in this case, it seems like the RNC was reasonably amenable to Twitter's purported requirements.
> It's a huge amount of work, and if the applications were made in 1990's, the code is likely legacy.

Which begs the question, can legacy code survive in an international network?
How do VSCode features get ported to the Monaco Code Editor[1]?

I was interested in using it but noticed the last commit for Monaco was in October.

[1] https://github.com/Microsoft/monaco-editor
I lived in NoVa for a bit, and found that employers would strongly rather you already have clearance, and don't really care if you're clear-able. Most places I looked had no uncleared work to fill so they'd literally have to hire me and sit me behind a desk doing nothing for months waiting for my clearance. That was usually the deal breaker.

I'm currently probably not clearable anymore (married a foreign national) so it's less relevant for me now, but I agree it's a nice area.
Horrible article. The Razor's a rule of thumb, nothing more. This is trash science. See logictutorial.com
I am not sure it is a good idea to pick your employer like an investor would.

An investor in startups is going for high risk, high reward investments. For every individual investment they make, the chance of any sort of return is quite low; they make up for this because the rare startups that succeed make enough to compensate for this low success rate. Since they are making a lot of these high risk/high reward 'bets', they can be fairly assured they will receive the expected value in return.

As an individual, you only get to place one bet on your employer. For most startup employees, that means they are very unlikely to get any sort of payout because of company success. It doesn't matter that the 'expected value' of working for a more-likely-to-hit-it-big startup is higher than for another company, since the probability is that you will not hit it big.

As an individual, you are more concerned with things like salary, working conditions, and personal enjoyment of the work. Those are the things you are CERTAINLY going to experience; the tiny chance of huge success is most likely not going to affect you.

I think there is a good analogy to poker here; in Texas Hold'em, two aces are the best starting hand. There is almost no situation where it is best to fold them before the opening flop; your expected value is always positive against ANY other combination of opponent hands.

However, there are a few cases where even though you have the highest expected value for your hand, it is in your best interest to fold. One such case is if you are playing in a tournament, you are in the money, and two people with much larger stacks have already gone all-in. In that case, your best bet is likely to fold; even though you have the highest odds of winning the hand out of everyone, if you LOSE, you are out and can't keep playing. Even if you win, you will still have the smallest stack and are unlikely to move up any spots and win more money; if you fold, though, someone else is likely to be knocked out and you can move up.

It seems counter intuitive, but this holds because expected value only works as your primary decision making point when you can make many bets; if you only get one bet, lower risk with lower reward is often better for you even if the expected value is lower.

Think about it this way; lets say you only have $1,000, and you need it to pay your monthly rent (if you don't pay, you will be kicked out and be homeless). Someone comes up and offers you a bet; you bet $1000, and you get a 1% chance of winning $200,000. In terms of expected value, this is a great deal! If you made the bet many times, you will expect to win $1000 for each bet made! However, 99% of the time you are going to be homeless. For most people, the choice is to go against the expected value and play it safe.
>I'm not really a software developer but...

If I had a nickle for every time I've heard this statement then I'd have enough to comfortably retire.

Yes, in theory, changing a column in a database (which in this case, happens to be a password) seems simple, but in practice, it's not.
2016 Boxing Day SALE of SpinaliS Chairs for Dynamic and Healthy Sitting
No, that part of the article wasn't there when I read it. Interestingly, the article ended with the word "Developing". I believe they meant that the article will be updated as and when they receive more information.
I know that we have embryonic stem cells (controversial) and adult stem cells that can be harvested from skin tissue (not controversial, possibly difficult/expensive?). I'm not particularly well versed in this field, but it could possibly be more expedient than other methods of getting adult stem cells. It could also be even more difficult/expensive, and that's assuming that they're pluripotent and not spleen-specific in the first place, though.
I mean any form of review be it automated or manual.

Money spent in code review processes and tooling is usually budgeted after unit testing and documentation, those tend to have quite small budgets and political willingness.

Yes to your last question, the good thing about languages that aren't copy-paste compatible with C, is that there isn't any easy way to write code the C way.
Thanks for your reply! It is very down to earth and to the point.
x0's algorithm was secure_hash(md5(pass), salt), you already have md5(pass) so this can be done in one bulk update.
I can see that. GTD works for me, but I also don't try to use it to drill down deep into every project. I have used it to, say, map out learning a language using specific resources a couple times.

Like, with Rust, I put in that I wanted to go through The Rust Book. I created a project with the book's title and a link to it in an org file. I created subheadings and turned them into TODOs for each chapter. Since I use org for literate programming, I included every example in this file along with my own exploration and toying with the language.

But an actual programming project won't be done that way. At most, from a GTD perspective, I note that I want to create a CLI TOTP implementation in Rust (as an exercise project). I'll capture it at a high level so I don't create too many projects (an unfortunate habit) and not finish it. So in my GTD list of projects I'll see that I'm working on "CLI TOTP in Rust", but no more details.

The details for that go into a literate programming org-mode file that drills into the details of what needs to be done. Somewhat GTD-style, but the tasks here never make it into my overall GTD action queue or schedule.

Basically, my system is an amalgam of what works for me at different levels. Dogma is rarely useful, in my experience. Flexibility and appropriation of tools from everyone else. Experiment, recognize failed experiments, latch onto personal successes, and explain what worked or didn't for me to others to help them do the same.
Political Detox Week is over. It was terminated early, but would have been over by now regardless. See https://news.ycombinator.com/item?id=13131251
The analysis is low quality for a lot of reasons...

1. It motivates moving to sv because there are "lots" of successful startups. Is the rate of successful startups higher than elsewhere?

2. Average reported salary is a garbage statistic. Compare median values, between jobs of equal "status" (Google != j-random shipping company... Compare Google sv to Google Seattle within job title groups)
On a similar note, if you're going to tell someone they're wrong about something, you owe it to them to explain why. Otherwise they won't (nor should they) take your feedback seriously.
Thanks. Comments moved thither.
For an IdP at the scale of Yahoo, the can adopt something as complicated as supporting versioned passwords and migrating credentials to the latest secure algorithm upon successful login. You have the clear text password at that point. You can store metadata such as the version (or algorithms) used to hash the credential.
I used to as well but if you still can access it you should delete it: https://help.yahoo.com/kb/account/close-yahoo-account-sln204...
I love VSCode and Flow but to be honest, the Flow integration could be better (and I'm sure it will be, it's just a matter of time).

There is a bunch of annoying bugs waiting to be fixed, e.g. the one about the imported types [1].

In the other hand, I don't blame the maintainers. The Flow team is a really small team and the VSCode extension is obviously not the priority. :)

If you guys see this message, thanks for the amazing work on Flow!

[1]: https://github.com/flowtype/flow-for-vscode/issues/23
You don't have to defend Trump if you don't want to.

1. WP article reads like a "top 10" clickbait article. Only a few things in that list are accurately associated with economic or social liberalism. Liking Hillary Clinton doesn't make you a liberal, for example. The press thing at the end is also absurd.

2. Being right about Hillary Clinton's wall thing doesn't make you a liberal. I don't know why you included this.

3. ??? See #2.

4. Once again, Obama or Hillary being less "liberal" doesn't make Trump more liberal.

>The policy ideas appear in hindsight to be inflaming rhetoric. Make deals, build a wall, and deport people in the US illegally. The funny part is that those things are exactly what is happening today. Maybe the deals will be different, but there is already a fence across large parts of the Mexican border (fun aside, Obama and Hilary voted yes for it as senators[2][3]), and under Obama more people have been deported than ever before[4]. So really, no change.

and

> Appointing DC elite and/or 1%ers to cabinet positions is basically par for the course. Maybe Sanders would have appointed more normal people?

Yea, which is the point: he is actually totally predictable, and like I said, the junk about him being hard to predict is nonsense. You said he was unpredictable... but now you're disagreeing with yourself? I'm super confused on what you're trying to say.
I don't know why there are so many non-answers or flat out incorrect answers to your question.

Yes, js devs use debuggers and have for years. Firebug was created and popularized for browser js 10 years ago[1]. Node.js was released 7 years ago, got a debug option one year later using node debugger. It was CLI based and a bit shit. Tools which leveraged Node's debug protocol and Chrome's developer tools (node-inspector) for example were started 5 years ago[2]. Most recently some group associated (maybe on?) the Chrome team started creating a cleaner debug protocol and integrating directly with the Chromium project[3]. That's become the gold standard and is the standard way of debugging for Node 7+[4]. VSCode uses that protocol to offer debugging directly from the editor.

1. https://en.wikipedia.org/wiki/Firebug_(software)

2. https://github.com/node-inspector/node-inspector

3. https://github.com/nodejs/node/pull/9028

4. https://nodejs.org/api/debugger.html
Show HN: Shrimpit – a CLI tool for checking unused JavaScript and JSX exports
If Yahoo goes down, I won't have email; or at best I'll maybe keep a Zoho. I hate Google's mail interface, I hate the way they make 'conversations' out of discrete emails, and I especially hate their lack of folders. I use GMail begrudgingly at work, and only when necessary, and every time, I look at it and go, "what dipshit ever thought this was a functional way to deal with email?" As a dedicated Windows user, I'm more likely to use iCloud than GMail if Yahoo goes down; but I doubt that.

I like Yahoo email as a user. Yes, they've made mistakes, and I accept that. I'd prefer their mistakes over Google's superiority complex.
I disagree with you regarding Activities. For apps they do most of the screen management the developer needs just fine, especially if they are backed by a strong view and data model.
If you download the App you can actually really quickly make out where they leverage the single Fragment (switch the project category via the drawer) and it makes sense there; but I think the same App build with a single Activity and Fragments would be much messier (especially regarding animations and back-navigation) and they'd gain (next to) nothing.
Complicated, you say? https://pbs.twimg.com/media/CxfCRzbVQAAXszJ.jpg:large
Pleasanton is extremely expensive due to its top notch public schools. Your old boss was doing extremely well if he could afford a home there.
For one, the backstack story for Fragments is a lot more sane than whole "Task" concept for activities (The backstack for fragments is a list of fragments you can manipulate and debug very easily).
Axigen's free e-mail server is pretty solid and easy to set up.
No, but there are libertarians who believe that risk mitigation skills never be required up front, no matter how unable the party at fault would be to restore whatever was lost. (Note: Some things cannot be restored at all; lives and disability being the obvious cases)

The point of government is to mitigate external and unacceptable risks, and we have grown this system based on experience over hundreds of years. Some super free market types seem to argue that we should throw all that away and then institute systems that, over time, will just reinvent the same things. My guess is they believe they will personally come out on top during the reset period through whatever strength/privilege they inhabit.
Send me your e-mail, I'll get in touch. I hope to keep on doing Econ with machine learning whatever happens. I did just apply to an econ tenure position, but it was not in the US.
Anyone recommend any introductions to Xamarin?
Take a look at Snowden, Poitras, and Greenwald's communications and the recording of the footage for Citizenfour as an example here.

They had all already stopped relying on any closed system to keep their communications secure. They were all using Tails to communicate through Tor without leaving a minimal unencrypted footprint. At the point where you are relying on Tor to communicate and are explicitly using Tails to keep your communication secret then why would you start relying on a Macbook, running a proprietary OS, with non-open crypto, to hold your secrets if you're already scared the neo-Stazi are going to break down the door and steal your unlocked, decrypted Linux machine that you have all of the trust in the world in? For that reason alone you would skip the Mac.
printf-debugging is a fine way to debug a ton of cases, especially programs with concurrent components. The process of debugging step by step isn't necessarily superior or faster.
I looked at a number of other sites using it [0] and found it was very easy to use. I don't go too far into things though, just really interested in hits, uniq, referers etc.

[0] https://www.google.com.au/search?q=inurl%3Astats+inurl%3Adas...
The State of Technology at the End of 2016 – Stratechery by Ben Thompson
I'd like to believe that. However, I was recently asked to test a new website for an organization I volunteer for, and discovered their "forgot password" flow emailed me my plaintext password. I wrote an explanation of why this was bad, and how it could be fixed, to a non-technical friend of mine who works there; he passed my email to the (Bay Area based!) consulting shop that did their website. The shop sent this response:

"We do not store passwords as a plain text in database. We have functionality which encrypts and decrypts passwords. We have only ecnrypted passwords in the database.

Almost all other servers use one-way encryption. In this case, passwords cannot be decrypted from hashing."

Again, this is a Bay Area based shop. For code written in 2016.

I was shocked to receive this, but it (among other things) leads me to suspect that there are lot of people out there, in positions of power, who aren't just ignorant, but who actively cling to password-storage anti-patterns.

I'm at a loss for how to fix this.
It's not the same thing.

C# "Pattern Matching" is little more than destructuring or switch on steroids.

However, much like how the compiler assists you when writing subclasseses so that you've implemented all the required methods, real Pattern Matching (F#) gives you the same guarantees from the compiler that you've handled all the possible cases appropriately. This makes real F# pattern matching much more useful than "switch with destructuring" and helps you grow your programs in a safe way. The C# way has all the same problems as the switch statement which gives no feedback about what cases you've handled.
The IAS was founded in 1930. 100 years is still 14 years off.

An academic who got an appointment there remarked that he was given a room with a desk and a nice chair and a window, and was expected to spend a lot of time there thinking, alone. This was very mid-20th-century, the concept that hard problems could be solved by hard thinking in isolation. Fermi once remarked "Sometimes you have to keep thinking past the point where it starts to hurt."

They do encourage socialization. They're said to have a very good wine cellar.
Reply your messages on WhatsApp using funny GIFs
Did you just draw that?
Specially in Britain the Freedom of speech is in danger. I would like see more discussion about it.
I agree with you as well. It makes deep linking easier since you don't need to recreate an entire fragment backstack.
Not necessarily, because of collisions.

The password "foo" may encrypt to the hash "12345". If an attacker were to discover that the hash is "12345", they would look for a password that hashes to "12345", which could, hypothetically, be the password "bar". They don't know the original password "foo", they've simply discovered an alternative, which happens to match the algorithm enough to unlock access.

In general, rainbow tables are used for identifying and attacking common passwords, but that doesn't mean that the algorithm is insecure.

Insecure algorithms can be attacked through collisions, which don't necessarily give you the original password, they just provide an alternative password which is accepted by the algorithm. The distinction matters when it comes to password reuse, because if Site A uses MD5, but Site B uses sha512, finding a collision that grants access on Site A doesn't necessarily give you a password that will grant access on Site B.
Fragments are one option. Another is just to use regular Views. There are libraries to help you with this such as Conductor.

As for Activities, they are usually overkill for most screens. They don't allow for seamless transitions between screens and prevent sharing UI components across screens (e.g. a Toolbar). Fragments and/or regular views have the added flexibility of being able to use more than one at a time and allows for easy re-use and view composition.

Like I said in my previous comment, the only really good reason to create additional Activities is to provide additional entry points into your app. Otherwise Fragments or Views will suffice and provide greater flexibility and improve the UX in many cases.
Related: former Yahoo security engineer talks about a backdoor Yahoo installed for the NSA to read private emails...behind their security teams' backs...

https://diracdeltas.github.io/blog/surveillance
Assuming they can keep it from catching on fire or de-railing. I'm happy to be out of NOVA/MD/DC.
> I've had a very similar experience in my career so far as a dev. My code used to be full of magic, auto-guessing things based on how methods are named, etc. I've moved away from that, it wastes more time than it saves.

Speaking of magic or trying to be too clever with your code reminds me of the Grep Test [0], which I always try to conform. In the end it's not fun forcing others to deal with your magic. Remember: code is read way more often than it is written, so don't be lazy to type a bit more — help others.

[0] http://jamie-wong.com/2013/07/12/grep-test/
One time I talked to a Google recruiter, and that was the message he conveyed. "Sure, you can work at a satellite office, but if you are interested in your career, Mountain View is where you want to be."
1) Make youtube training videos in your area of expertise.

2) Use your training videos to solidify your presence on the internet with an accompanying blog/newsletter/and kindle e-book.