skysight-inc/HackerNews huggingface dataset:
> Doesn't this just mean that IQ Scores don't measure what they're supposed to?

No, it does not mean that IQ scores don't measure general intelligence.

It does mean that things some people believe about general intelligence may need to be reevaluated.

> But if you can increase this with schooling, isn't it just how smart you are right now?

That intelligence (and particularly IQ) can change over time, and that there were environmental contributors to that change has been well-know for some time.

That education in adolescence is a relevant factor is perhaps new, and certainly challenges the treatment of education and intelligence as orthogonal factors that contribute to outcomes.
How I Earned a Green Card in Eight Months (not Eight Years)
I agree with the sentiment but there is a difference between a programmer and software engineer. Programmers who just move pixels around a page and hook up a news feed? Sure those will be gone, automated away not blue collar (imo).

Building the systems to make the tools to automate that away? Those will still be white collar jobs. Pushing bits is easy, converting an abstract vision into a scalable, maintainable system is hard.
Diceware is a decent option for security questions. They work fine over the phone.
Yahoo has been a company for a long time. I imagine your conversation happened round about 1999 when using MD5 wasn't insane. And then they were just slow to upgrade.

It's still bad, I'm just saying the conversation about what hash algo to use didn't happen yesterday.
Concerns me that the rate hike is primarily based on KPI reporting that less people are claiming unemployment. Oh well, guess you have to hike the rate to lower it again.
St. Louis tends to be one of the best cities for Ag stuff.
Let's not forget that high ranking officials in the US govt. used Yahoo to send classified information to print at home.
10 Pieces-10 Outfits: Bernadette Alverio
Anyone up for trying to get a corporate death penalty law on the books?
It's most likely just part of the due-diligence required for the merger.

Yahoo brass probably decided that publicizing this information wasn't worth the PR hit, and so they buried it, but Verizon doesn't want to take on the risk of a potential lawsuit, so their lawyers required Yahoo to disclose it if they want the deal to go through.
I thought Klathmon was pointing out say that they an attacker could say that they just mashed on the keyboard and that would be good enough for the fallible human on the other end of the phone.

Anecdotally, I had a time where I couldn't remember may answer to a secret question except that it was a type of food. I called in and the human on the other end let me reset my password with just that explanation. Take that for what you will, but it seems like if someone knows you use passwords that are random strings, they can use that to break in.
This is being discussed at https://news.ycombinator.com/item?id=13180101
Its scary to think about the consequences if the only reason Yahoo knew they got hacked was that they are more, and not less competent at security. Do you think the security team {insert retailer, other nontech company with a login screen here} is somehow MORE competent?
You're right, but it goes beyond that.

Yahoo used to be a titan. I was a regular user of Yahooligans back in the day. Yahoo (at one time) had been my go to search engine. I can't say that it was ever my primary email account, but I used it. I used Yahoo Messenger. I was part of a community that centered around some Yahoo games. Yahoo used to be a titan that was a direct Google competitor in the realms of communication, search, news and entertainment.

Sure, I can delete an account for any service belonging to any company(!) if I want. But when you use a service, there's an explicit level of trust that they'll protect your information to the best of their ability. We assume that we can use their services as our primary driver without worrying about MD5 hashes without salt. We assume that they'll take more security procedures than a student making a toy app testing boundaries in a 400-level course.

Sure, we can delete our account, but this is an unnerving situation. It's not like Yahoo was thought to be some back alley operation where everyone nervously awaited news like this. Yahoo was a direct competitor and contender to some of the biggest digital companies on the Web. This level of incompetence is mind blowing.

At least it is to me.
What canaries for sure operate this way? That definitely makes things a little harder for the boys in black.
Chatting with the Cloudcast about Monoliths and Microservices
Why not just ban the usage of fireworks for various festivities such as Diwali or enforce stricter vehicle inspection code during annual registration? I am sure there will be "some" folks jumping through/going-around the enforced laws but it can make a significant difference when a good majority starts following them and such following gradually increases every year. In this way more and more cities start implementing similar routines.

Sometimes we get so much caught up in "cool" or "fun" projects that it becomes easy to ignore simple yet basic implementations that lies in front of our eyes all-along :)
You forget that Linux is a stable and well-rounded OS that also lets you run a lot of hardware that Windows can't.
I laughed too hard at this.
Current law seems to dictate that if the NSA wants that, it's what they're getting. Blame the government.
Seems like "the year of the blockchain" is the new "the year of the Linux desktop".
I find the headline very interesting. It's very inviting because of the way it expresses a sort of epiphany about doing it wrong on a mundane programming task. One is tempted to read it in order to see if there is some great insight to this problem. just maybe it's applicable outside this one problem. It begs the question: if he's been doing it wrong on a fairly mundane thing, maybe I am too. I need to see what this is about.
Honest question: why did you need a Yahoo account?
It was kind of a pain in my experience to use the Chrome debugger to be your main editor. I've not used VSC for this, but I imagine it's nice to not have to flip back and forth between tools.
I am pretty to the javascript/node world. The debugging situation is pretty pathetic in my view. Most people I know use a ton of logging like we did with C/printf 25 years ago.
I dunno, everything looks like vapourware until it exists. For the time being I think they're supported by EU funds and they do still seem to be making progress. I would not bet my house on it appearing though.

Of course not many people are going to literally write their own firmware, but I can see it being compelling to be able to expand your range of codecs, LUTs etc in a relatively cheap camera, and not have to put up with what the manufacturer thought you'd like.

As for ML, I think it's unlikely to destroy your shoot if you stick to the basics like the focusing and exposure tools (I forget what it actually offers tbh). RAW and more experimental features are probably a bad idea on anything serious, but then so is using a consumer Canon camera.
Every time I look at my webpack config and it's nested properties with no descriptors I yearn for Maven and it's rigorously-defined XML.
For me, old habits sometimes come back. If there had not been return fire to the second comment, it might have been deleted.
Just in case, StackOverflow has some variations for JavaScript, although not that much optimized ;)

http://stackoverflow.com/questions/1583123/circular-buffer-i...
I don't know what to say. Get out more, I guess? Change your group of friends? There's a million people that live here and I'm always meeting new people and striking up conversations. Some stick, some don't. I actually don't hang out with anyone from my childhood anymore, as I've made so many new friends over the years.

I'm glad things worked out for you in any case.
It occurred in 2013
You could use an IMAP client such as Thunderbird to copy your mail away from these clowns to another service that supports IMAP. Fastmail has an IMAP-based bulk importer that in my experience works well. I used it to hoover all of my mail out of GApps and into my FM account.
And nobody ever seemed to say "hey, maybe we should be using something more secure". Yahoo's been around for how many decades, and the fact they were still using MD5 in 2013 is just shameful. Yeah if it was some legacy code from 1993 you can probably excuse it, but I just can't believe after 20 years nobody thought it was a problem.

I'm not really a software developer but I really can't imagine it being a huge change. Instead of md5(pass) you could probably just change that to secure_hash(md5(pass), salt), add another column in the database for the salt, and rehash all the passwords. Customers wouldn't notice. Rehashing the databases would take a while, but otherwise that's really not a huge amount of work.
I recently decided that if I don't trust the company not to send me spam, I don't need to avail myself of their services. It might not be possible for everyone, but it's made my life a lot simpler.
With JSON web tokens (JWT), the client or server must know the secret key used to sign the token in order to validate it, but anyone can view its payload.
Could do it if you knew the JWT token text in theory?
What do you mean by a password that can't be reasonably brute forced?

EDIT: To clarify, I mean specifically with md5. I'm by no means an expert, just curious because I had considered md5 so broken that this comment caught my attention.
There are many, many active communities and mailing lists still using Yahoo Groups.
..and it took them three years to find and report it?
That sounds awful. I'm fairly certain, Alaska and all other airlines use a 3rd party service to handle retrieving lost luggage. Having dealt with that myself on other airlines, it's a miserable experience all around with nobody knowing the complete picture.

That said, it's no excuse for the airlines to just accept bad behavior by their 3rd parties.
Thanks!

While I agree with the others calling this a type of sampling bias, I've seen this type of error frequently enough that I think it deserves a more specific name.
To be fair, why does it need to be imbedded in the code? Why can't it just be a plain text link to a binary file (your vector image), which automatically embeds for supported editors?

What you're talking about is turning source code into a binary object. That's fine, if you use an editor that supports it, but you shun all other editors when you do that. There is a middleground that doesn't involve making your source code into rich text, imo.
Do they have higher rates of autism than Somalis in Somalia?
Reliably exploiting the latest Ubuntu Desktop by attacking the crash reporter
For me that's one of a reasons that as full-time Ruby/RoR developer I've started learning (& loving) Python. Some time ago I've started to realize that too much is happening under-the-hood in many of the libraries I'm using and somewhat in my applications. After few months Python is much more verbose and readable for me and I don't have dilemma whenever I should I implement certain thing this or that way.
The complexity isn't that much of a problem. Windows server + smartermail has a nice UI all the way. The problem is cost.

[edit] by the way I wonder how useful would be a tutorial "for dummies" of how to set up your own mail server from scratch. I assume that users who would be happy to pay for their own server but feel it is too complicated would likely be windows users, i.e. wouldn't mind having to pay for a license and would like to use an environment with a relatively exhaustive UI. I'll give it a try.
> 3. The content, clearly GoT inspired, was likely posted in places that have agreements jeopardizing the ownership of said content and, yes i am stretching, copyright and trademark.

You're not just stretching it, you're confusing the two. The law doesn't say anything about the need to protect trademark, only copyright. Additionally, there is nothing there to indicate that the artwork ("content" as you called it) has any inspiration from GoT. It's not based on a character from the show or the book and it doesn't depict an event or scene from either.
Ha ha, Santa Fe, the city of enchantment, though last time I was there there were plenty of broken liquor bottles at the bus stops. To each their own though.
The only thing I need a Yahoo account for is the yearly March Madness bracket. I'm hopeful the hackers can use it to make a better one that I could.
As a data point: when I was a teenage code monkey in 2004 writing PHP I already understood that unsalted MD5 is unsafe.

According to Wikipedia:

* 2004 it became possible to find MD5 collisions at a rate of one per hour on a cluster

* 2005 it became possible to do this within "a few hours" on a consumer laptop

* 2006 it became possible to do this within one minute

* nowadays it's possible to do this "within seconds"

Plus, as others have mentioned, it's now possible to find collisions instantly by using widely available rainbow tables, e.g. https://md5db.net/decrypt
That's just a hack though it just generates html based on the markdown you type.

It for example won't help me with reading emails in console :/

BTW: Things like this makes me wonder if I'm the only one who still uses MTA.

If there was a defined standard text/markdown the emails would simply be sent in markdown which could be nicely rendered in GUI, be readable in plain text and also safe unlike html.
Learning how to make http requests in Angular 2
Our long-term future is in nuclear and hydroelectric power. Our near-to-medium term future requires continued use of fossil fuels.

Your summary of my argument is completely off-the-mark.
Different strokes but I just had the severe displeasure of constructing a pom.xml for the first time and I would pay good money to never do it again.

I would infinitely prefer to use JS tooling over Java's in general so maybe that's not saying much.
Unsalted MD5 has been demonstrated to be vulnerable to collisions since 2005. Rainbow tables existed way before 2013. There's no excuse for a tech company of this size.
Go away Jetbrains.
Also, communicating and negotiating with human drivers. You have to do this all the time in a city like London, mostly on two way roads where there's only room for one car, due to obstacles (roadworks) or parked cars.

In complex situations, flashing lights and honks are not enough, you need to verbally communicate with other drivers.

I would eat my hat if an AI could handle these kinds of situations.

So in short, I'll believe the hype when I see a video of a full auto drive through London at rush hour.
OK, so we agree that the lead auto-car may still apply maximum braking unexpectedly. Therefore the follower needs to leave enough space to compensate for reaction latency, difference in braking power, etc.

So how does data communication (or lack thereof) affect this?

The follower can instantly detect that the leader is slowing via sonar/lidar/radar, right?
Stripe Atlas would be a lot better if it would have more of the kind of payments that CoinPayments allows: ETH, DASH, Monero, Litecoin, ...

I believe that Stripe Atlas has only Bitcoin as a cryptocurrency, correct?
I guess you're not a Perl programmer, otherwise you'd be using duct tape instead of shoe laces.
It is hard to find well maintained JS libraries in these days. Thanks a lot for the mature work done here, especially in terms of documentation. So many OS projects launch their new shiny versions in such a rush, they leave their users in darkness for a very long time.
I believe you can deduct state from federal tax, which would save ~2.5% in marginal tax. In addition, social security phases out at ~120k so that's another 7.5% savings. So the difference is almost a wash if I understand correctly?
Why Google isn't for me
It gets/got made ~10-15 years ago. (I don't understand the "no salt" thing, though. That was common practice even ~20 years ago on Linux machines, so I'm mildly surprised that it wasn't implemented in this case.)
Nice idea, if the color works for you.

Edit: I see it comes in clear, which would be perfect. I'll have to pick me up some of that.
Around here those tests seems to be careful to avoid maths, memory etc and only try to test your ability to recognize patterns or find missing solutions.
Hashing the hash isn't a good idea, you're reducing the domain of your secure_hash function to the range of md5. The way to do it is to have a "password hash algo version" column and when the user puts in their password, you verify against the hash[algo](password) and rehash with the later version, changing the algo column for that user.
Facebook's New Certificate Transparency Monitoring Tool
Considering the op mentioned per capita rates, that seems to directly reference "density."
State of Startups 2016
So, using the US Federal government as an example, the sociopaths would need to convince 600-ish random people to do what they want on a continuous basis. Currently, the sociopaths need to convince ~100M random people to do what they want once every two years. The former might be superior, but it's not obviously so.
So now are you burnt out when you get to work?
In my case, it's because I still have some very old accounts in there. Accounts that predate not only this password manager (LastPass) but the previous one (KeePass) and which in fact go all the way back to something that started with "Yet Another (YA)" back on a Palm device.

I really ought to go through and do some janitorial work in there, but some of those are for sites that actually still exist and for which those logins are likely still valid. I don't care enough about them to go log in on each and change passwords, but I also don't want to simply delete them and leave yet another orphaned account.
Nasty Gal: the dangers of ephemeral growth and focus
If I just wait a bit longer, more features from F# will be available in C#. Still not making the jump. So close.
there's a couple of things that these major providers getting pwned teaches you:

1) their security isn't good just because of their scale/size (that begins to seem more and more like a false-assumption nowadays)

2) migrating your email to a new provider is quite difficult (consider that the average person will have just 1 - or 2 - email accounts and they link EVERYTHING to it)

3) the price of ads/convenience is no longer worth it. I'm assuming at least a sizable minority of internet users are using ad-blockers these days. They can't get your eyeballs, so they package and sell your data. Granted, you can probably now get the same (raw) data on the black market by paying a fraction in bitcoin and you'll get to see those billions of emails telling people someone attacked their farm in farmville from 2009

Lastly (and I really hope this happens), Yahoo implodes/collapses (cause the average Joe won't migrate willingly) and leaves a vacuum for their 500+ million email users. Hopefully the smaller providers (Proton, Migadu, Posteo, Tuta, etc.) get at least 10% of these users and the email-cartel is broken (somewhat).
I fully believe that there are plenty of contexts where that's true - particularly in any throughput oriented system where the buffer is large. But if you care, measure.
I live in the BA and work in tech, and I'm not super-stressed. Neither my peers seem to be. It doesn't mean we don't work - but not more stressfully than I'd expect to work anywhere else. Maybe I'm just lucky.

The downside is everything is so expensive. Housing, of course. But also everything else too, services, other things. If you can live frugally, it may be to your benefit - you get higher income and keep low spending, win. But if you can't or work lower income job, it may be a problem.

The upside is there are a lot of exciting opportunities around, both in employment and in conferences, lectures, events, etc.
I had a Yahoo account entirely to use a Yahoo email list; I used to have it for Yahoo chat, but I haven't used that in years.

So I ignored the hack a few months ago. I also never got notified that I was vulnerable.

Just now I tried to log in to see if my password had been invalidated. Nope. It was my old insecure "pattern-based" password (myprefixYAHOO) that I use nowhere any more. Probably short enough to have brute forced with MD5 in a few minutes at most.

And yet...no spam sent from my account. No spam in my account (except some kind of announcement from "Aabaco, the new name of Yahoo Small Business" from a year ago. Just some of the mail from the email list that petered out over two years ago as the list transitioned into a Meetup group.

So I guess Yahoo either has considerably more than 1B users, or there were simply so many compromised accounts that they didn't bother trying to use all of them to send spam.

Changed the password just now to something secure "just because", but it's hard to care.
Sure, I did this (and more if you count my 401k). I don't think I was that frugal: I certainly didn't want for anything, and ate my fair share of sushi.

Like the article mentions, saving a lot is easy if you're fine with a roommate and living in a non-luxury apartment, but if your housing standards are higher than that then it's tougher.

This is, of course, at the compensation levels talked about in the article. Some companies (early stage start-ups, banks) pay much less.
Move to area of high cost of living for work. Retire to low cost area.
> Xeon Phi can be its own cpu though

yes and they are priced accordingly ;-)
You would have to be extremely well paid and frugal to save $100K in two years. Sure, it's do-able, but wow. Of course, this is HN, so there's always someone who knows someone's brother's roommate who makes $150K/year at Google but that's a pretty high salary. And to be able to keep $50K of that given the cost of everything? I don't see how it's possible unless you are single, have no kids, no existing debt payments, don't put anything away into IRAs, 401ks, etc. and are are extremely frugal.

But if you do and are, you have $100K. Congratulations. That does you no good when homes are $1M+. Keep saving.
If it's a password so long and complex it wouldn't be in any rainbow table computable in reasonable time. While MD5 can be computed quickly, there is still a limit to how many you can compute -- and there are an infinite number of possible passwords if they aren't length limited.
By now I suspect you can simplify it down to just matching on the RHS for any domain registered to Yahoo.
Show HN: GitLogs - using GitHub Archive and BigQuery to find trending repos
Each JWT has an issued at date, so you just need to reject all tokens issued before that time. In addition to invalidating all tokens if there is a breach, each user account can have its own datefield to invalidate all the tokens for that account if a user changes their password or whatever.
I imagine that including those payment types would have a marginal, at best, effect on Atlas as a product. In total they probably account for < 0.1%(likely even less) of all online transactions and are not a real blocker for anyone starting a business unless the business is dealing in those currencies.
A preimage attack for MD5 has complexity of about 2^123. So, even if you get the MD5 hash for a password, it will be exceedingly hard to find a password that has the same hash (assuming the original password is long and random).
I find that where there'a magic, there's usually tutorial-style documentation.

Not to say there's anything wrong with tutorial-style documentation in and of itself. However, it becomes problematic when it is the only documentation.

Then you just find yourself digging around in source code because the "It's easy, simple and magic!" style of documentation turned out to be woefully inadequate, if not actively confusing.
MD5 collisions are probably not important for passwords.
I put in ycombinator into the actual tool, and got some very interesting results:

Domains:
ycombinator.com
*.optionking.com
optionking.com
*.movie-blog.org
ssl4679.cloudflare.com
*.ycombinator.com
movie-blog.org

Valid From: Apr 15, 2014 - Oct 22, 2018

Is this just due to shared certs on Cloudflare?