skysight-inc/HackerNews huggingface dataset:
> Practically, I commit only when it's ready (building, passes tests). So why would you commit without pushing (unless you're offline)?

I haven't set up a VCS server yet. I've fixed a security issue and haven't hit the embargo date yet. I'm doing exploratory coding (prototypes, refactorings, etc.) that may be discarded or reworked, even if it builds and passes tests right now. It passes all local tests but needs to be fuzz tested overnight before I'm satisfied enough to commit it upstream - but want to keep working in the meantime. I have more related changes to make before wanting to sic reviewers or the CI build process on my changes. I want to push my changes to a dev environment, but not a production environment just yet. I want to rebase to make my history look cleaner, but can't be bothered with doing so just yet.

I commit when it's not ready: I use WIP commits instead of stashes, and sometimes commit more often than I build. This has advantages: It can keep the individual diffs cleaner - an autoreformatting of a file to fix whitespace issues, and hand-implemented refactoring, should be separate commits for cleaner, more readable and reviewable diffs. This has drawbacks: In a centralized VCS, these will either get merged together into one messy commit (common), or they'll get blindly commited without (re)building for all permutations and occasionally break the build, or you'll slow everything down painstakingly testing the entire build after every minor permutation.

> but I'm not going to become an expert in a tool I use five times a day at most.

I'm no expert either. That said: In the interests of smaller, simpler, more reviewable changes - both for whoever might be doing a code review, and for myself if I mess up and want to figure out what I've done in the past few minutes to break something - I interact with my VCS much more frequently.

There are days I make 30 or so commits, and I likely diffed each commit multiple times before committing and/or submitting.

Aside from making it way easier to figure out what the hell it is that I've done, being able to finger a specific small changelist as having broken something has saved me tons of time I'd otherwise squander on false leads and disbelief. One of the nastiest heisenbugs I've had the misfortune to debug, I manually did the equivalent of a 'git bisect' on a perforce repository to track down the offending commit for. Totally innocuous change, totally to blame for a fruitless 2 week session of debugging in vain thanks to a buggy system API it used. So innocuous and seemingly unrelated, that I had to reproduce the issue in a simple test app to convince myself it was really the problem. I could've easily wasted another 2 weeks had the changelist been a little bit larger.

.

TL;DR: Smaller commits have saved me months of work, I figure. Committing without pushing lets me commit without shifting gears, encouraging smaller commits.
A Single Typo May Have Tipped the Election
Not just for the baseline flier. My last flight out of SFO with United, I watched as the gate agent called the police on a first-class passenger for getting on the plane without first putting his standard-sized carry-on in the stupid little metal thing. I vowed to the gods in the heavens at that moment that I would never fly United ever again. I should mention here that three out of my last eight flights with United were delayed at least four hours, and we sat on the runway for most of that time.
It's really not. Unsalted MD5 has been shameful for a long, long time.
The answer "it depends" is a cop out. There's no analysis, because even a cursory look gives a logical answer.

Moving to a high cost area to gamble for a position that might help your career in the future, given any unemployment for more than a month makes the living arrangement untenable, is a high-risk gamble. The idea that working for a big company changes your employment chances is about the same as what school you graduated from. It gets you an interview, you were probably going to get anyway in another geo-location. In a lower cost area (even relatively lower like Los Angeles) you end up with lower chances for a startup (with a brand that might eventually become household) but the experience isn't much different and landing your interviews are a cakewalk…talent pools are smaller everywhere else in the world. The positions you might qualify from, are about the same from some no-name sports gambling company as "I worked at uber for a year". Your experience at your role is what matters, you're a worker not a business consultant. The answer is a definitive no, and the headline is baiting a false equivalence, hence Betteridge.
Apache Commons RNG v1.0 is released
Why do you keep making up straw man arguments? There's literally nothing in this comment that is responsive to anything I've written, or to the pledge, or to the immigration issue I brought up.

Have I not demonstrated that I'm willing to listen to you and address arguments you bring up respectfully? Is there something I said that made you feel like your best way forward was to play message board nerd games?
I'm a Dvorak user. I use the programmers dvorak [dvp] layout specifically, which moves more frequently-used symbols in programming languages into more ergonomic places.

I've switched about 7 years ago, and the ergonomic benefits are just enormous. Typing is so much more pleasant, smooth, and fun, compared to QWERTY. Note that I still touch type both, and have decent speed (~100wpm in Dvorak, ~85wpm in QWERTY).

The pain (about 2 months realistically) has been totally worth it. Also the way my brain cringed during the switch made me feel like it was a pretty great brain exercise.
Depends. My old boss (also married with 4 kids) did it. He lives in Pleasanton in order to afford a house and commutes to Mountain View. Has to get up very early to beat the traffic though. The upside is that, while I obviously don't know exactly how much he makes, from what I know about people at his level at Google, he is undoubtedly doing quite nicely.
Dumb question: why use power of two sized rings? If I know the reader won't be more than 100 behind the writer, isn't it better to waste one element of a 101 sized rings instead of 28 of a 128 sized ring?
> August 2013

> hashed passwords (using MD5)

I don't even know what to say.

> investigating the creation of forged cookies that could allow an intruder to access users' accounts without a password. Based on the ongoing investigation, we believe an unauthorized third party accessed our proprietary code to learn how to forge cookies

How is this possible? Aren't most auth cookies just a session ID that can be used to look up a server-side session? Did they not use random, unpredictable, non-sequential session IDs?
At least anecdotally, you learn to touch type better if the keys on your keyboard don't match the layout you are learning. Almost better to just unlabel all the keys.
Human drivers run red lights all the time /s
This is a time where a decent password manager comes in handy. I can look in my password history to see what my password was in August 2013, and see if that password is still in use anywhere else, then change the password on those sites.
No, sorry. They're borderline criminally negligent. When you have 1bn passwords stored in raw md5, a decade after the first rainbow tables were published, then you don't deserve anyone's business or your freedom.
> major.breaking.minor.patch

That's the same thing as projectName.major.minor.patch in some respects. You could just rebrand the project if it's a completely different direction. There's not a technical reason to keep the name, just a marketing/political/organizational reason.
What is your mother's maiden name?

T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl
So, the scuttlebutt last time was that they disclosed the hack due to a potential Verizon buyout forcing their hand. Seems as though this could be the same thing, generally speaking.

Can anyone enlighten me as to how Verizon compels Yahoo to disclose this information? Or rather, how does Verizon know about these intrusions, if they do?
Composite USB Gadgets on the Raspberry Pi Zero [act as Ethernet+Keyboard]
You can now broadcast live video from the Twitter app
I am currently hearing "formal Systems" at my university and that got me interested a bit. Can somebody comment why in practice it's so hard? In and ideal world I would image that certain languages are easier to prove (haskell vs C) and with the right tooling it should be able to prove many things quickly. Some things will always remain hard, but right now i don't see formal proofs of programs at all (i only hear some rumours that some companies use it at some small scale). So what's holding it back from being practical? Not enough engineer Man-power? Or is our theoretical understanding still not developed enough?
Direct link to the quora thread which is the source: https://www.quora.com/What-are-the-negatives-in-working-in-a...
On the other hand, you can toggle it off by View -> Hide Status Bar.
I highly doubt it will - developing cameras for professional use is fairly capital-intensive and commercial offerings have such a huge head start that the open source proposition isn't very compelling to cinematographers. The best camera is the one you have in your hands right now, not the one that sounds like it would be great in the future. Even Red camera almost choked on its own hype about the Scarlet and had to do a marketing pivot to get into the mid-price bracket.

Ultimately, people drop thousands on a pro camera in order to shoot beautiful pictures, not because they want to write their firmware, so you have a chicken-and-egg situation. And while a few people do write amazing firmware - Magic Lantern being an excellent example - that's a liability on a commercial shoot. I might use ML on an art or micro/no-budget project, but as a producer I'd probably nix the idea; you absolutely don't want to be locked into someone's quirky personal workflow to the extent that you can't fire them if they turn out to be shitty photographers or hard to work with on set.
> I like the idea of Semantic Versioning, but it does cause problems where if I'm going to do several breaking releases one after another I have to keep bumping the major version, and I hate that. I've actually put off doing breaking changes simply because I didn't want to bump the major version number, but I don't like that either.

When you're doing backend/API things (where breaking changes matter), I sure hope you think a million times before making breaking changes.

Can you imagine if someone had to go through millions of lines of his code to make sure nothing broke, then, a week later, you broke his code again?
Ask HN: Mobile app builder with native source code?
Is there any drag&drop mobile app builder, which produces native source code? A code, which can be easily edited?
My thoughts too. I was "yawn .... holy hell another billion accounts". It will be interesting to see where Verizon lands on this.
Another thing people say is: "the science is fraudulent, any competing evidence gets buried for disagreeing with the establishment".

You are not helping with that.
Yeah, but in the bay area you can live in a small apartment, save a ton of money that you put into stocks, and then eventually use those investments to buy a house outright in a cheaper part of the country when you move.

> Houses aren't retirement plans in most places. And I think that's good.

Absolutely; the fact that they've worked that way in some places is completely poisonous. For one thing, it's obviously not sustainable; you can only have the inflation-adjusted average value of a home double so many times before it's literally impossible for anyone but the actually wealthy to afford. Secondly, it creates a strong incentive to oppose building more housing, which causes all kinds of problems.
CVE-2016-8745 Apache Tomcat Information Disclosure
I have to agree with the OP, I know a few Googlers (my wife used to work there) who transferred from satellite offices (say Venice or NYC) to MTV and all of a sudden their careers took off. Generally, being physically there where the action is (HQ) seems to pay off for ones career.
It depends on what you need. The new built-in path intellisense only applies to JavaScript and TypeScript files for require or import statements. The path intellisense extension specifically is much more general and offers additional functionality that you may find helpful.

I work on the VSCode team on JS and TS support, so please let us know if you run into any problems with the new path intellisense feature or have ideas on how it could be improved.

Thanks
You are correct sir. My 1200 sq. ft. house in the mid-peninsula area, in a very mediocre neighborhood, is currently valued on Zillow at approx. $1.1M.

3000 sq. ft. homes around here barely exist, but you're probably in the $3M range for that kind of place.
Anyone using Visual Studio Code for Rust development? If so, how is it?

https://areweideyet.com/

Going by feature set alone (plugins included) it appears like a good choice, though I've yet to try it myself.
> Sure, SHA1, scrypt or bcrypt with salt were already common back then, but it's an entirely different story than if they had used it today.

Not an excuse, this is Yahoo, not a PHP shop in India doing some low budget contracting.They should have a top of the line security team enforcing the most recent secure practices. Furthermore I got no email from Yahoo telling me that my account may have been hacked. Both incompetent and irresponsible at the same time.

By the way I did some PHP dev back in 2011. bcrypt hashing was already common practice. How can you come up with that argument in good faith ?
honest question: if you're going to the extent of already using a password manager, why isn't every site getting a unique password?
Well, good for you. I don't think your situation was "average" really, but kudos on the savings :) Coming from a guy in NYC whose monthly expenditures are through the roof...
Also malicious (allowing NSA to search through everyone's emails).
Joining one of the FANGs as your first job is a great way to kill your chances of developing a highly diverse skill set early on. Good luck doing anything interesting when there are 120 superior engineers who are bored out of their minds all vying for the opportunity. Working in a smaller company that has real problems to solve tends to be much more rewarding. There's a reason the technical leadership at the big 4 tends to be comprised of engineers who came from elsewhere.
Save a click on a 1-comment discussion:

https://yahoo.tumblr.com/post/154479236569/important-securit...
> saying we should act the same way in either case is just an auxiliary way to shut those people up.

I am not convinced that "making obviously terrible arguments" is an effective way to shut up one's political opponents.
This is a much more difficult problem at large companies where meeting rooms can be a scarce resource, and other meetings that run long can negatively impact yours.

Having a plan for the meeting and having everybody trying to keep the meeting short helps a lot. I think if you're in a place where you need to write ground rules for meeting there's a larger cultural problem that needs to be addressed.
Indeed. Manhattan residents rarely own cars (IIRC around 20% do), and when they do it's always for some weird miscellaneous reason, these being the most common ones I've noticed:

- it's a toy (like a motorcycle or boat would usually be) or

- it's a business tool (like a sedan owned by a cabdriver or a minivan owned by a deli owner) or

- it's owned by someone who recently moved from a suburb to Manhattan and brought their car along by default (which most of the time, lasts no more than a few months before they learn the transit system, get fed up with parking, and sell the car) or

- they're a law enforcement officer or family member (because LEOs, even personal cars, usually get away with parking murder here, so from a parking perspective, manhattan looks as convenient as a sleepy suburb, to someone driving a car with the right protective LEO markings to ward off tickets)

- more than one of the above
Hey, you seemed to have hijacked my account. Care to explain?
I hate to be glib, but: those driverless cars will fit right in in San Francisco.

(But seriously, traffic enforcement around here is terrible and is reaching preposterously dangerous levels for pedestrians. The intersection in that video is next to the MOMA downtown; human drivers block the crosswalk regularly, and I've seen them run the red exactly as depicted in the video at least a few times.)
I have a similar tale. Was having pains in my wrists in grad school and decided it was way past time to unlearn my broken QWERTY touch typing technique (in my case my left hand was shifted a key left such that the pinky was homed primarily shift/caps/tab/ctrl and my right hand "wandered" to compensate). Trying to relearn QWERTY itself just lead to falling back into old habits. Forcing myself to learn an entirely different one (in my case, also Colemak) was a huge part of making good habits stick and I've been glad I did so.
Looking at the list of changes (https://webpack.js.org/guides/migrating/), it seems like a lot of "magic" has been removed.

That's good. It's kinda funny how this is a very frequent pattern: Build something full of magic and, as you grow more mature and hit pain points, end up removing the magic.

I've had a very similar experience in my career so far as a dev. My code used to be full of magic, auto-guessing things based on how methods are named, etc. I've moved away from that, it wastes more time than it saves.

Anyone else with the same experience?
Wouldn't cleaner power plants = less pollution = less deaths?
Of the Greenwich T3m92uGKhWMRV7Um0WVF50LKQNowpoe0FWwWryL2r9jkuAHyLTCY8QoY79iMiSjo6CHCZGWl's ?
I'm speechless.

More and more are migrating to cloud these days, I expect more and more epidemic leakage will come.

I host everything myself except for email, which is always a headache but contains more private info than all others I manage combined. Maybe it is time to run a small email server again but it is easily said than done, gosh please give me something like a working PGP or whatever for safe emails(PGP is dying from what I read)...
Thanks for the info. :)
Which only works until you call in asking for a password reset and when they ask you the question you just say "I just hit the keyboard a bunch".
"Before you quit your job" by Robert Kiyosaki. It definitely did...
Notice that this is yet ANOTHER hack, not the one HN was talking about a few month ago. also notice they were still using MD5 passwords AND without salts ... None of these hacks have been disclosed directly to their users, I never got an email saying I may have been hacked and I should reset my password, irresponsible.
Previous discussion: https://news.ycombinator.com/item?id=2172398
I'm hoping Verizon kills the deal. It would send a powerful message (unintentional on Verizon's part, but irrelevant) that a major data breach + installing NSA's rootkit on your servers could one day cost you billions of dollars, as well as give you a forever tainted reputation.

https://motherboard.vice.com/read/yahoo-government-email-sca...
But what is missing in sublime?
Is the database and/or specification open source? A formal verification of a distributed system sounds very interesting.
The Myth of Model Interpretability
I considered moving to Portland, until I read about how a big earthquake would pretty much completely wipe it out:

http://www.oregonlive.com/earthquakes/index.ssf/2015/07/the_...
Ask HN: What hackernews clones are out there?
I wonder what opensource scripts exist out there that provide more or less similar functionality to hackernews?
I almost hope the data is made somewhat public so Troy / https://haveibeenpwned.com/ can get a hold of it and provide the public with reassurance.
Not yet -- I'm using TS for an unrelated project to my Vue projects; but I've read that support is on its way.
I've been in the game industry for a long time and I've felt the same way. This had the opposite effect on me though, I wasn't very interested in AI because game AI wasn't very interesting. Now I'm getting more into AI largely due to reading HN for years, but also because of interesting applications in computer graphics.

There are games in the 90s that used machine learning techniques, Specifically Black and White and Republic: The Revolution, which were both worked on by Demis Hassabis who would later go on to work for Deep Mind on AlphaGo (https://en.wikipedia.org/wiki/Demis_Hassabis). I also think some racing games have used neural networks and some fighting games use hidden markov models in modes where AI adapts to player strategies.

I currently believe the game industry will adopt machine learning techniques in computer graphics, animation, procedural generation, game balance, simulation (vfx), and offline tools before agent behavior. Although, if NLP and speech recognition get good enough I can see it that stuff getting used pretty widely in certain types of video games.
> Too slow. RSA encryption is very expensive.

So use a public-key algorithm that is designed to be faster, less expensive, and use smaller keys -- e.g. NaCl's crypto_box, which uses Curve25519 under the hood: https://nacl.cr.yp.to/box.html.

> Also, RSA keys are enormous.

We're talking about devices that have as a primary goal the storage of lots of high-resolution media (photographs and video). I think you could find a couple extra KB to spare for an RSA public key... (although, again, there are better primitives than RSA that should be preferred).
Web tokens, for example, don't necessarily include just a session ID. Some include the full session details within its payload. This can be quite useful, actually, because it offloads session-lookup onto the client.
Spatial Indexing and Zero-Downtime Patching for Amazon Aurora
Burning more fuel...brilliant plan.
Who can take the idea of "Silicon Valley" as an engine for social change seriously when industry leaders behave like this?
Yep, I've become very fond of explicitness. Leaves nothing to question when others are working on the same code.
There are ways to help avoid many types of failures & machine crashes that beginners encounter, but solutions tend to involve physical and software integration that most machine shops just don't have the expertise to build or margins to justify spending on.
Agreed. I ended up moving across the bay and living in Berkeley while working in SF just for that reason.
I mean, I'm in the suburbs... Haha
Guys... let's just delete our Yahoo accounts. That company can't go bankrupt fast enough. It will sell our data for quarters.
Consider yourself lucky. I'm in the same boat but I don't know backend development, which there are far less resources for.
I've used WellnessFX and been very happy with it. Not sure what cheap means to you but the Baseline Diagnostics only is $198.

https://www.wellnessfx.com/baseline
vue-class-component[0] seems to be adopted by vuejs org, and I'm planning to use it in my next project.

[0]: https://github.com/vuejs/vue-class-component

EDIT: Just saw this on twitter: https://vuejs.org/v2/guide/typescript.html
1) As Yahoo "upgraded" all password storage in UDB (where all login / registration details are stored) to be bcrypt before 2013, I'm curious how this was possible.

2) Yahoo doesn't use a centralized session storage. If you know a few values (not disclosing the exact ones) from the UDB, it's theoretically (guess not so theoretical now) possible to create forged cookies if you steal the signing keys. To my knowledge, the keys were supposed to only be on edit/login boxes (but it's been a while so I may be forgetting something), so this is a pretty big breach.
No built-in support yet, but this new extension is worth trying https://marketplace.visualstudio.com/items?itemName=geddski....

The vim extension (https://marketplace.visualstudio.com/items?itemName=vscodevi...) also supports vim macros
Thanks Tyriar!