skysight-inc/HackerNews huggingface dataset:
Yeah, such comments are the spice of conversation; without them, it's a bit bland. Somehow they work better in person.
LOL this is rich:

"...identified data security issues concerning certain Yahoo user accounts."

Certain...more like all up to that point?
CBORD, Glyph and Wegman's are the only other major players in town to wit. There's a small number of start-ups too but nothing that would sustain an economy like the colleges do.
It looks pretty good congratulations to the team.

There is an issue though that I find so annoying and I just hope they fix it.

I set up the external terminal to git bash on windows and sometimes when I'm deleting commands with the backspace it doesn't really delete the full word, hard to explain but as an example if I type "nani" and then press backspace "nani" stays but I know it has been deleted because it kinda flicks so I type "o" now I have in the terminal "nanio" and sure enough if I now type the name of the file it edits it.

Hope this makes sense, I put up with it because I'm really enjoying the product and the speed of development.

Big congratulations to the team.
There are likely to be a lot of identity systems using the password in the database, all of which have been coded to look for an MD5 hash, not a salted hash. This means code in a number of applications have to be updated at the same time.

The typical way around this is to create your new destination column (e.g. sha256 with salt), and progressively have applications reference this column rather than the MD5 unsalted column.

It's a huge amount of work, and if the applications were made in 1990's, the code is likely legacy. If Yahoo are doing regular code security reviews, this will likely have been put in the pile of "we need to fix, but it's too costly to do".
But I'm afraid I have no sympathy for outraged users. No more than if it was gmail or hotmail. They didn't pay for the service, they got an email service for free. It's hard to complain when it is free. And they did enter into an agreement where they sell their privacy against a free service.
Yahoo was my primary (as in only one not provided by my isp or school) e-mail address from when they bought Geocities until the early '00s. I've been disentangling as many services from them as possible over the past couple of years.
> PGP is dying from what I read...
Can you please provide some references for this? What are the alternatives?
JPMorgan hacker fugitive arrested at JFK
I would definitely suggest getting along to MelbJS nights - aside from the fact that there's some good folks and great talks, there's usually a bunch of people who will advertise what roles their companies are usually hiring for.

also, make sure your portfolio site is up to date and has lots of projects that you're working on.

If you've got no commercial experience I wouldn't really recommend going to an agency, mostly because agencies are too expensive for companies if you're just going to hire juniors - plus there's usually no shortage of junior devs, especially this time of year.
But I just downloaded the previous version. I am really impressed about the speed of deliveries.
I get that. But weighing family > enterprise is pretty easy to do.
For those of us with only a layman's understanding of the term "general intelligence", would you mind posting a definition?
In 2012 I created devices mockups and was selling it since on graphicriver. https://graphicriver.net/item/devices-responsive-web-mockups... . It was sold more than 3400 times already, and made about $800/month in the first few months. Now the income is somewhere around $25/mo but it's been 4 years since. The funny thing is, that I have never seen these devices close-up in real life before creating these mockups :)
I believe in this case Yahoo wasn't previously aware of the hack - they were notified by law enforcement, which presumably found a file of the information somewhere during an investigation. There was enough info to let them ID a time period, but nothing that lets them know the who/how of the breach.
There isn't much involved in learning AutoCAD or Solidworks either, nor basic manufacturability. The difference is that these are generalized tools not tied to a single manufacturer.
Keep in mind stock vests after some time and then you're back to base salary. I've found the practice of yearly "evergreen" grants to be rare even in the Valley.
Does it have an FPGA? Because AFAIK you need to emulate custom chips to run Amiga flawlessly (although I think they can also be sw-emulated, but there is a price to pay in terms of performance)
I recently moved from EMACS (after using it for ~10 years & ~6 languages) to VSCode. There are loads of things that I miss but overall it's been a fairly smooth transition.

I'm moving because I spend most of my time writing javascript and felt that no combination of emacs modes allowed me to keep up with a proper IDE. Emacs is a tool to learn once and use for a lifetime (and I will continue to use it for other editing tasks) but I found that I was increasingly having to learn outside tools in order to gain the benefit that IDEs could hand me for "free" (free like a puppy, retraining your fingers takes months).

Things I love:

- Intellisense is immediately superior to anything I've used in EMACS.

- Debugging from my editor. This was available in emacs for C, PHP & Java using GDB or similar but it never made it's way to javascript as far as I can tell.

- Goto definition.

- Good typescript and Flow integration

Things I miss:

- IDO Mode (FML I hate Finder for moving through directories)

- Creating files with just the keyboard (probably possible but I haven't figured it out yet).

- Kill ring

- Moving around the code with just a keyboard (ctrl-v and the sort).

- Non-intellisense completion. When your caret is at the end of a word, Command-\ in EMACS completes to another word from the same buffer that has the same prefix and continue to swap through words on subsequent presses. Very useful in a dynamic language.
The client can hold onto the token indefinitely, the server doesn't care. But next time a request comes in with that token it will be expired. The server validates the timestamp which is part of the encrypted payload that only the server can decrypt; instant validation and no DB lookup.
I'm not sure Average Joe really associates these hacks with incompetence or negligence. Those nasty hackers are making victims of poor Yahoo.
Well, you can only rehash if you have the plaintext password. So you have to wait until they login again, or force a password reset for everyone. In the former case you're stuck with a bunch of md5 passwords hanging around for any account that's not very active, and for the latter you'll lose some percentage of active accounts whose reset process is for some reason no longer functional. You could mix-and-match the two methods (start with the former, force the latter on any stragglers after, say, a few weeks) to minimize the damage, but that's more work and a number that someone somewhere in the organization finds very important is still probably gonna go down.

(I've never had to do this myself, so these are just the most obvious options I came up with. Possibly there are others.)
I do most of my dev work on Windows or OSX. Xamarin also works with VS and it seem like VS runs on linux (https://code.visualstudio.com/docs/setup/linux). It is the same as deving for Xamarin on Windows, you have to use VS.
I'm actually surprised they're relying on Activities for the views in the app. I'm not familiar with how the app works, but this is typically an out-dated approach. Activities should really only be treated as entry points into your app.

Also, not a huge deal for an app, but the package structure is organized by layers, not features. Makes Java's non-private access modifiers essentially useless.

The general style of the source code is solid though. I wouldn't be upset if I had to work in this code base on a daily basis.
What really raises the score is practising on IQ test type of riddles and questions.
Fair enough, as I believe I've had that happen. Random string for one of my financial institutions, needed to reset something. Pull up 1PWD, with random string at the ready and...they asked me questions that could have been pulled from a copy of my credit report. I didn't ask, so I'm not entirely sure, but I wonder if they didn't look at the answer, said to themselves "fuck that" and went with Option #2.
The point of making backwards compatibility the first number is because the subtle changes need attention drawn to them. There's little risk of people accidentally using things in a broken way when projects are renamed. It's about clarity of technical communication. There are lots of ways to communicate big direction changes, including changing the look and feel of something, adding code words (WD Caviar Green), putting out a big publicity push (v32 is a whole new game!), and so on.
But it's not like if we didn't have a pretty much continuous stream of major data leaks for the past 5 years. Surely yahoo engineers occasionally open a newspaper...
https://en.wikipedia.org/wiki/Salt_(cryptography)#1970s-1980...
You could do both though. Give much more security in the short term and upgrade anyone else who logged in later.

I did ask about the hash of hash thing some time ago and ptacek claimed that's a reasonable thing to do.
> when you're simply introducing breaking changes (but doesn't qualify as a "significant" release).

I can't picture this. Breaking changes are always significant, aren't they?

Got an example?
?? Would you be more likely I make the jump if C# had more
of F# features or less likely.

I wouldn't hold my breath for anything approaching parity.
If the super volcano explodes do you really want to be alive after?
This could be a valid metric if your goal is to find a place where restaurants are less likely to be crowded. The more restaurants per person, the less likely a given restaurant will be overcrowded or have a long waitlist.
This is the same Yahoo that wants us to switch to a LESS secure password-less Yahoo Key?
“Cognitive Hack”: The New Battleground in Cybersecuritythe Human Mind
webpack is great. HMR and code-splitting are killer features. Only thing that I'm worried about is tree shaking. There are a couple of long standing issues about problems with classes and export all statements. Rollup is missing code-spliting, webpack doesn't do tree shaking well and complains about bundle sizes. Not sure what to do. If somehow rollup could be integrated, that would be perfect.
Sure, but you'd want the driverless cars to at least follow the laws and rules of the road. I've been driving in SF ever since I got my driver's license, and as the city has gotten more and more traffic over the years, I think the traffic problems are as good as can be hoped for. There are just too many cars, pedestrians, buses, and bikes sharing the roads in the downtown area. Traffic enforcement is difficult when you can't get around easily and I think SF has done a pretty good job of keeping the traffic moving. One thing that they've done was to have traffic control officers in the downtown area to ensure that traffic moves along. This looks to be the best solution for the amount of traffic.
OK so I'd like to invite the pure free market types to explain how this gets fixed without any government, including no lawsuits. Because I keep hearing from free market types that 100% of phishing victims are ignorant and basically deserve what happens to them, if they can't learn that they're being duped they deserve to be duped, they somehow think wholesale loss of trust ends up being focused only on specific companies rather than entire technologies. And so on.

So how are these externalities dealt with where there is no such thing as insurance for this type of breach? There's no way to put the toothpaste (my private information in the form of answers to personal "security questions") back into the tube (only my brain or nearby sphere of influence).

And this goes along with IoT devices that aren't having their known exploits patched by their manufacturers. Similar problem different details.

So without broad laws that say this is wrong and here is a mechanism to attach a tangible cost to this information so a proper risk assessment is done, I imagine we keep seeing this happen with essentially no punishment beyond what Yahoo already is getting punished for.
Yeah, that's true, although I've counted myself lucky for being largely unaffected by it.

That's what you get for being the richest city in one of the poorest states. Upscale art galleries and horrible drunk driving statistics.
Mistakes to Avoid When Starting a Subscription Business
Sorry, there's no shielding Marrisa Mayer from this. Yes, she had only been there a year or so. But that's long enough she should have been on top of security. Yes, she's just killing time until she leaves now anyway. But, the symbolic statement is still important - she should resign.
What's wrong with a rake?

And maybe also a tarp if there is some distance to move the leaves.
CommonMark has not published a formal grammar.
Momo by Michael Ende. It made me think about how to work at a sustainable pace and to focus on the things that matter in my life.
> Indians actually don't care about climate change and global warming and will not care for a long time to come.

Granted I only visit India about once a year but that was not the impression I got at all. Climate change is discussed in the media (English and non-English). India is already suffering from many of the effects; heat waves, drought and water shortages and much of the general public and leadership seemingly agree on the cause. I was actually pleasantly surprised how seriously it's taken there compared to the US.
Microservices don't solve the volume problem, a monolith can have multiple to deployments to handle volume.
What I don't think is visible from the video is whether the engineer or safety driver in the vehicle are in control. According to Uber's release, every self-driving vehicle in their fleet has a safety driver and an engineer that can take manual control of the vehicle. While it's definitely possible that this was a mistake with the AI, I don't think we should rule out the possibility that this was human bravado/impatience.
I'm not really seeing the chat-bot aspect they seem to have a crush on. What am I missing?
There are also some pretty obscure ancient languages there -- besides the obvious Latin, Greek, and OE, there's things like Tocharian and Gothic, which I've never seen more than just the names of, but there's actual lessons on the site!
Some states like CA have a legal requirement to notify in the event of a breach, so hiding this event is illegal.
It's amazing that they're telling users to change their password/security questions 3 years after the hack.
Quick, time for Laravel Elixir to find another beta version to bundle before an actual release happens...
Doing a google search for the link showed me the title of the document which I remember reading in the past. The overall coverage of Y&T cookies is more or less accurate at the time of writing back in like 2010/2011, but there's a bunch of mostly minor technical inaccuracies too. I don't want to comment on much without rereading it, but I remember the description of Sled ID made me laugh (which btw I'd guess less than 1% of current Yahoo employees knows what that is).
Young children have poor finger dexterity making this knot untenable.

You can go even further with this knot: https://www.youtube.com/watch?v=Gm5ItoIJ4sg Which is a slow and poor knot but you can do it with even one finger on each hand.
Not billing for meeting time? Amateur :P
- When you shut down for the day, leave your work in an unfinished (even uncompileable) state. This makes it easy to start the next morning, and is a good way to warm up to get back into context of the project.

- If you start the day with a clean slate, write three things you'd like to do today. Pick the one that will take the longest and do that first. This is Mark Twain's "eat a frog before breakfast" advice and I think it helps a lot.

- Install SelfControl.app and start it for 8 hours immediately when you sit down to work. No matter how in control I think I am, I'm always amazed at how my reflexes take me to some distracting website before I even realize what I'm doing. SelfControl stops this habit by blocking distracting websites and making me aware of them. (Pro tip: don't write an unblocking script)
I'm baffled. Without a formal grammar CommonMark is useless. Who implements a parser without a formal grammar?
I was responding to the claim that it console.log was the only way.
Thanks for the sourcing. I forgot how much I loved that top quote from the HN comments:

"tl;dr lymphatic nodes go all the way up the back of your brain and into your sinuses. We'd been ripping them out and throwing them away every time we did autopsies or dissections because they were attached to the inside of the skull. Oops."

- @anigbrowl
Here's a list of actual pronounciations by actual French speakers:

https://forvo.com/search/Coq/fr/
I think the answer is obvious: he wasn't paying attention.
Maybe the Uber driver was the one who ran the light after taking manual control?
This [1]guy dropped out of school to pursue his own data science curriculum using nothing but MOOCs (including Udacity's nanodegrees) it seems.

1. https://medium.com/@davidventuri/i-dropped-out-of-school-to-...
Didn't they do that with 2.0?

https://github.com/webpack/webpack/issues/3275
I thought this was going to be about the center for advanced studies:

http://www.cascorporation.com/
You're demanding accountability from insane people.

I learned long ago, never to wrestle with a pig. You get dirty, and besides, the pig likes it.
Read more at: https://www.brainyquote.com/quotes/quotes/g/georgebern137450...
Yes, my wife and my son have been supporting me throughout the 3 startup exits I have overseen. They have sacrificed a lot of time and effort to support me. In return, I have earned enough money that none of us will ever have to work again.

I love having a supportive family.
Most? Mine is plastic.

If you're talking about cell phones and tablets sure—but you certainly don't type with both your hands like on your laptop...
It's a lovely tool, but the design is very ugly!
The article states:

"In parallel to the image format, OCI is developing the so-called runtime-spec for describing the runtime execution environment that container engines should provide."

I thought the run-time spec was formalized and that we were waiting on the OCI image format to be standardized. Is that not the case? This was from a recent conversation I had with someone at CoreOS.
I really dislike articles/posts/editorials like this. There's very little information in here from an objective standpoint and it boils down to little more than "I heard this bad stuff so I don't like whatever". It's fine if someone doesn't want to work at Google because they've heard bad things, but was it really that important of a paradigm shift that you decided to dedicate an entire article to it?
Wow Trump is so alpha it's unbelievable.

He's negging the company that he uses to communicate with all of his fans. And he knows they won't do anything about it.
I went to the University of Michigan hackathon (MHacks) back in October of this year which was, for some reason, hosted in Detroit (absolutely _terribly_ done hackathon, btw).

I was shocked at how bad Detroit actually was. In my opinion, it's actually worse than what people say. A story I heard from one of the people that live in the area is that people leave their cars unlocked and devoid of valuable belongs so crackheads won't break their windows to search for money. They're still going to search, but they won't break the windows.
>> comparable problem to "play every possible game of chess" for a computer to figure that out.

my_password + iterator is a very common password convention.

It would be a poorly programmed computer that didn't consider this possibility.
you could be right. i only started thinking about OD with this thread and have no inside information. that said, a marketplace seems like the ultimate ambition for two reasons.

1. one co-founder is a VC who previously led a marketplace business, paypal. VCs are already conditioned to aim for marketplaces. tasting marketplace success as an operator probably only deepens this reflex. it's harder to eat ground beef when you're used to wagyu.

2. if a marketplace is possible, why not? it creates a larger moat to keep out competitors and assuming they don't abuse monopolistic power, a single marketplace can make pricing fairer (more buyers, more sellers) and more efficient (lower fees). instead of 6%, what if OD enables a world where transaction fees are 0.5% or 1%? the classic disruption playbook (hi, telsa!) is to aim for a dominant market position by starting high, then using technology to steadily reduce prices, expand use cases, and gain market share.
"Intelligence is the ability to react to change" - SHawkins

The best programmers are always learning new languages, programs, frameworks etc. Avg programers get good at 1 thing and stay with it.

The real difference is that the first group is training their brain how to learn and adapt quickly - that is the skill that will keep them employed long past the days of simply writing code.

Writing python or C is not the skill. The skill is how quickly can you deal with a new problem you have never seen before.
Talking about using "the blockchain" doesn't qualify. Rather the opposite. The real value will be on the fringes of that ecosystem and has little or nothing to do with chaining blocks: secure multiparty computation, testing the potential of synergies in data with bloom filters and differential privacy.

Source: running an ethereum meetup since 2014 and (very likely) writing the world's first crowdfunding contract in LLL.
How meetings are run:

1) Wait 5 to 10 minutes for everyone to join

2) Spend additional 5 minutes getting your computer hooked into the projector and shared with remote participants

3) Read through your powerpoint

4) Ask for feedback. Receive comments about your choice of font for the powerpoint.

5) Thank everyone for the meeting and head to the next one.
Please list your alternative solution for storing photos where capture/torture is not a possibility.
Matching the video to the local geography, looks like it starts at Heath Farm: https://binged.it/2hPbvaN

There's an implication in the story and some comments that this is a rural location, but it's quite close to Cambridge - ARM's HQ is only about 2 miles away. It's open country between ARM and Heath Farm, but as Cambridge airport isn't much further, deliveries there might be a bit tricky.
Whether or not that's true, your lifestyle isn't dictated by what "everyone" does, it's only dictated by what you do. I know lots of people who are workaholics or spend all of their non-work time with their families, and I know as many or more people with rich and varied lifestyles that go out and do stuff with friends all the time. It's what you make of it, like many things in life.
The OCI runtime and image specs are currently 1.0.0-rc3. Hoping they both hit 1.0.0 final in early 2017.
> including no lawsuits

Are there are "free market types" who actually believe there shouldn't be any form of sanctions whatsoever for causing harm? I've talked to quite a few hardcore libertarians, and I've yet to encounter anyone who takes it that far.
The way I look at it: Your career is time boxed like a baseball game. You only get a few at-bats then you're done. So you can use your chances to swing hard for the home run, or you can go for the safe base hits. But you don't get 100 chances.

Investors on the other hand get thousands of at-bats. They're only limited by the amount of money they want to invest, so they can diversify all they want.
for those who don't know, quality of life in LA is entirely dependent upon your commute. your life can either be the single best big-city experience in the country, or a hellish, dystopian nightmare that will send you into a suicidal depression.

i'm not joking. if you move to LA, plan ahead.