skysight-inc/HackerNews huggingface dataset:
I second this. I use Life Extension. However, I've been paying out of pocket. I'm interested if there's a way to get it covered at all.

By the way, this is really just using LabCorp, and you can order similar tests directly via LabCorp. Might be worth price shopping between them, and checking out their different test options.
There are a few things I feel are missed in this write-up.

The calculation on needed drive size may be misleading in the long run as we move more to cloud storage. It seems the method you get data from your iPhone to your computer is to use iCloud or other cloud provider, so your data is already in the cloud.

The battery issue is not addressed by apple, but Microsoft seems to be leading the way here with continuum and the surface book where replacing a part of the hardware extends the life of the overall device. A new surface book base gives new life to an existing tablet.

In the phone arena, we could see a phone that plugs into a doc which has it's own GPU and higher powered processor. The phone is essentially managing your settings and apps, data is in the cloud.

It's a very interesting time...
I would personally never use an IDE for any of my (non-mobile) development. No way no how. That makes things like WebStorm or whatever DOA for me personally.

My best guess for your downvotes is that your comment isn't only nonsense and inaccurate, but also pretty churlish.
I moved away from Ithaca about 2 years ago and lived there for a year. It's still pretty cool. My main reason for leaving had less to do with the vibe and more to do with the job market and the fact that all of my college / high school friends and some of my family were in NYC. It has very limited opportunities, but I feel like it's a good place to move to if you're further along in your career. Also seems like a good place to raise kids. Not sure if I'd go back but it's definitely up there on the best places I've lived list.
I don't see what this has to do with the linked article, which is about the basics of incorporating a company and managing money and risk.
Wow, thanks for the in-depth reply, I'll definitely check out emacs!
Knock-Knock... I pay for Y!Mail Plus. It's not just free users wanting a drop-box for spam.
Financial Fitness: Get Your Credit into Shape Next Year
But then you'll have to likely sacrifice several hours of your day just to commuting.
> Driving on winter roads is a lot like racing a car on a track with other drivers - everyone is near the limit of traction and a hazard can present itself very quickly

That is an excellent analogy.
I think the way to understand IQ scores is that they are proxies for measuring general intelligence (general intelligence being ability to solve novel, abstract cognitive problems). The art of designing an IQ test is in making it as good as proxy as possible. Usually this is done by either testing stuff that everyone has exposure too under a time limit (general knowledge, basic math, vocab) or by testing stuff that people generally don't spend time practicing (Raven's matrices). But if a person deliberately tries to cram for an IQ test, they may increase their score, without increasing their general intelligence. And so with any policy that increases IQ scores, you have to try and figure out if it really increased general intelligence, or just increased their familiarity with the kinds of questions that appear on an IQ test. This can be tricky to figure out.
Font Icons by Icalia Labs
While I agree the press is not your customer, I disagree that it is too slow or doesn't spell things out.

For starters, if the press doesn't like your product, odds are they will give some hints as to why. They may not spell out exactly what you should change, but they should give some hints as to why they are not happy (and it may not be what they say you should change).

In terms of speed, odds are you aren't going to get a massive press hit right off the bat. It will probably be some industry/niche blogs, local publications, etc. You only need a couple to start observing trends, and from there you iterate. Roll out the improvements, test it, and hell, even reach out to the reporters and ask if they like it better. It may get you follow-up press, and even if it doesn't, hopefully you'll get some useful feedback.
Man with Bitcoin wallets surgically inserted in hands talks about experience
I wish I could do this, but I have kids. They rule my schedule
Ruby should have List Comprehensions like Python
I love Python's List Comprehensions, and there is just no eloquent equivalent in Ruby. We should make it happen.
Haha, NSA maybe ? Or... how about big bad Russians ?
The link for deciding whether to be nasty or nice when enforcing open source licences is fascinating: https://lists.linuxfoundation.org/pipermail/ksummit-discuss/...

Linus talks about the loss of trust, community, and developers that plagued Busybox after their GPL enforcement lawsuit. I hadn't realized the consequences were so dire. That lawsuit is still sometimes held up as the GPL working as intended.
If you want to know if you are running a real business, answer this simple question.

Are you making money?

If you are, you run a business, if not, you run a liability.
MariaDB ColumnStore 1.0 is now GA
security is important, but lets not forget the strides theyve made in making meaningful connections with their audience via collaborative relationships with powerful leaders such as Katie Couric
Yea, you have to set your expectations lower here in the Bay Area. A 2K square foot home is absolutely ENORMOUS out here, especially for a single family. And good school neighborhoods are extremely expensive. You're not going to afford that combination working at ANY tech company besides maybe a few outlier high-salary companies.
Quorum-Based Commit and Termination Protocol for Distributed DBs (1988)
This complaint looks to me about some devs jumping to use the alpha version of v2 and got confused about which version the homepage points to. This is separate and a minor problem which they have fixed anyways.
Wait until they introduce a real name policy...
I think it comes down to culture.

The culture of the South Bay is relatively non-existent outside of small pockets like Palo Alto, Los Gatos, Mountain view, and maybe Santana Row.
It's geared toward raising kids and family life in general.
I really enjoy computer generated music and art simply because it plants the possibility in my head that we could eventually experience more music or art from an artist that's been dead for a long time. If a computer can "learn" what made Bach Bach (giggle), then maybe the thought processes that developed what we consider to be genius can be used to continue that legacy in new and different ways. Especially when people who are considered professionals have a difficult time distinguishing between the original and the computer creation, it's a weird, enticing territory we're getting into.
From everything I've read, the engineers did. The problem was that the security team had to go head-to-head with the budget team. And unfortunately, the budget team won - since the upper levels didn't feel that the IT security salaries were a necessary expenditure. And beyond that, there was concern that making people actually change their passwords regularly and requiring anything like security in said passwords was going to discourage users from using Yahoo and send them over to GMail.

Unfortunately... that argument wasn't wrong.
> leave your work in an unfinished state

this is great advice. I do this with writing, always stop with a few paragraphs to go, so you can pickup easily

SelfControl: I found an alternative for Windows called https://getcoldturkey.com/ - though I haven't tried it yet
A number of ISPs have used Yahoo to provide mail services in the past, so it's probably not quite as straightforward as that.
Does an insecure algorithm mean that you effectively have the plain text passwords?
Jack Dorsey says he likes having two jobs at CODECOMMERCE
Ask HN: Any small side project ideas for unemployment period?
I am facing an unemployment period after graduation and need something to do with my time.

Do you have any ideas for a small useful project that could be finished within a couple of weeks (until I hopefully find a job)?

It could also maybe be contribution of a small feature to some open source project.

I am somewhat tech agnostic, so all ideas are welcome. Thanks.
I actually wasn't aware there was also a paid service.

Though I doubt this is a large share of the 1B accounts.
Well, I'm 47 now and have had the open challenge since 1990 that if anyone can show me that the Bible is not what it purports to be, then I will have to renounce my faith and search elsewhere. I think that qualifies as an honest attempt :)

I'm also not convinced that falsification is the be-all, end-all to deriving meaning. I think it's a very useful tool, but it has its flaws.

Looks like we will have to agree to disagree that Christian Apologetics is merely about defending Christian doctrine. It does that, but it does so by encompassing historical, reasoned, and evidential bases. Is it proof? No. Is it a body of evidence that people can examine and decide for themselves if the message is plausible? Most certainly yes.
I'll be looking into this for 1.9, the issue tracking this is https://github.com/Microsoft/vscode/issues/14613
> In and ideal world I would image that certain languages are easier to prove (haskell vs C)

It is. That's why Coq is a pure functional language, rather more like Haskell than like C.

> and with the right tooling it should be able to prove many things quickly

Yes, this should be possible, and it is possible.

If you mean you want it to be automated: Isabelle/HOL has more automation than Coq. For many simple things, it suffices to tell Isabelle, essentially, to perform induction on a given variable and from that to try to find a proof automatically. It builds on several external provers to implement this.

What is difficult is for the system to know which existing lemmas to reuse and how to combine them. It's a bit like your math homework, except that these systems know more lemmas (i.e., have a larger search space) and are not always good at ranking them by relevance.

> right now i don't see formal proofs of programs at all (i only hear some rumours that some companies use it at some small scale)

Look up SEL4 and CompCert for a start.
Just curious, why should activities only be treated as entry points to the app? What are the downsides of the only-use-fragments-if-you-need-to approach?
Nope, but pattern matching will be in vNext.
Yeah if anything lawsuits/courts are central to their argument, that the owners of property will use legal recourse to settle damages to them, and that mechanism serves most of the functions of gov't regulation.
They actually fought in court about it, so I commend them for it
You're building a straw-man. Before trying to argue against a position you should try to understand it.
Using awareness of how to use a debugger is a reasonable interview technique WRT javascript devs. In general, ignorance is not a pejorative but if a candidate walk into an interview claiming to be an expert and I find out that you debug in anger using console log, I'm calling bullshit. They're either very green or too lazy to have investigated the tools available. Jr devs are, obviously, another story. Read up on how to use node --inspect for newer versions of node or node-inspector for older versions.

One common need that is a sad state of affairs in the Node world is performance tooling. It's available and competent professionals should invest in it once it becomes necessary but is a pain in the ass to setup and run.
"The fact that the first use experience is (from what I've heard) the very best pairing experience for any bluetooth headset ever tells that story quite well (all thanks to Apple's proprietary W1 chip, of course)."

From who? They're not available, not even any pre-release reviews around.
> So the same organ's name is related to both sadness and laughter, depending on the language.

... and in German it's related to craziness.
"Einen Spleen haben" literally "Having a spleen" means someone is quirky or eccentric.
They got yanked out by the emergency brake as I was getting in my car earlier today. This can't just be me.
Pretty much even if you choose a high entropy password like say:

`]{;&<C9v98QO#]M~Ff$>rQQQjoJkxm0ayM+gG,@vf*>#-{X4E>aZG(A1~tf<Wu

the MD5 algorithm can be broken using various techniques like collisions, unsalted I believe means that their database would accept the hashes the third party has. End result is they should have migrated away from MD5 after it was declared unsafe.
I have been in this situation, and you're correct.

Somewhere in the organization, a product team is going to throw a fit about usability and churn over the decision to reset user passwords en masse, or to force users to change them when they first log in. This isn't a slight against product managers, but one of the clearest indications of a company's overall security culture "health" is how the security, engineering and product teams choose to compromise and "pick their battles." Risk accepting vulnerabilities has a legitimate place when you have to balance product development and usability, but so does pushing back on egregious issues.

I don't have privileged insight into Yahoo's organization, but in this case it's pretty clear the security team should have either been more diligent in conveying the ramifications or less kneecapped by the surrounding org units, depending on the circumstance. More importantly, Yahoo should have "migrated" their passwords in the manner a parallel comment explains in this thread. This is what Facebook and other companies did after maturing their security programs (see "Facebook Onion" on how Facebook transitioned away from MD5).

Also good to note - there is evidence Yahoo's security culture improved over the years. The decision to go with MD5 almost certainly happened in the 90s, and when Tumblr suffered a breach all users were forced to reset their passwords. The capability and awareness was clearly there.
Devils advocate because I'm not a free market type: Can we sue companies for data breaches? This could solve the issue with large companies but not fly by night operations.
Markdown (2004)
I just fail to praise the attitude. "Let's faithfully reproduce the looks of 30 y.o. technology, pseudographic tables included, with make-believe over git".
BNF doesn't make something unambiguous.

I mean, Foo = "hello" / "hello" is totally acceptable, and if you have any indirection like Foo = XXX / YYY with XXX, YYY = "hello" you can then attach different semantics to XXX and YYY despite it being ambiguous. Add in more levels of indirection, and you have a lower chance of it being trivially obvious.
Well inbound email is really not a big issue from my experience. The issue (if any) is deliver-ability of outbound email. But that can be handled in any number of ways. (You can use someone else's smtp if there are issues or you can just follow best practices to have a clean ip address they are available).

I have been doing both inbound and outbound for roughly 20 years on our own equipment. But even doing just inbound gives you better control and in a way you are able to lessen the attack surface of being a large vulnerable target.
Also, the video that goes with the PDF is too funny! Just watched it on YouTube [0] again. Notice how he doesn't actually sign into Web Messenger, just goes to the login page? If he had, it would've failed. Same thing with him closing the browser before Yahoo Mail loaded. "Sensitive" reads and everything that did a write operation always (unless there was a bug) validated the cookie against the UDB. So even if you stole the signing key, without the values from the UDB, you would have very limited ability to do anything other than the trivial things shown in the video.

[0] https://m.youtube.com/watch?v=n2CNp_zmje8
Lengthy and comprehensive guide[1] but no support for LLCs (yet) which cost less to incorporate

[1] https://stripe.com/atlas/guide#incorporation
In Robert Nozick's Anarchy, State, and Utopia he argues the minimal state would be "limited to the narrow functions of protection against force, theft, fraud, enforcement of contracts, and so on." I'd imagine most libertarians would agree basic contract laws and some level of lawsuits should be acceptable to a functioning society.
I thought the whole point of the MD5 vulnerability was that the limit was 2^128 and as such there are more inputs that possible output hashes, meaning more possible input collisions.
Jim Lewis of eMachineShop also tried to do the same thing for printed circuit board design and assembly. The result was Pad2Pad, which would make blank boards and put the parts on them. The assembly part didn't work out commercially, and the board-marking service became one of many such services. Making PC boards is a well-organized industry - you send in files and get boards back without much difficulty. One-off boards are no problem.

Seeed Studio in Shentzen finally got the assembly thing working. They make blank boards and will put parts on them if you pick the parts entirely from their Common Parts Library. You can make most simple digital electronics projects using that library - analog and power, not so much. Seeed Studio has good prices but requires you to release the rights to your design, so others can copy it. Sort of like Github for hardware.
The real problem with modulo is at the end of the integer range. Add one and overflow and suddenly jump to a totally different index in the array!

BTW: read and write pointers, power of two, did that in BeOS (1998) and many sound drivers did it earlier than that.
To me, that seemed like the obvious way to do it when I needed it.
What does that even mean? People were asking about it in comments so I added information.

Are you accusing me of secretly living in the Czech Republic while hanging out HN to astroturf for WebStorm?

Was there a mistake in the comment?

Or, I hate to even ask, is this some sort of childish fanboy thing?
I have the same problem. If anybody has any good resources, please let me know.
This analysis is very low quality. Engineers move to the bay area not for salaries, but for equity and RSUs. It's not unusual to make your salary again in RSUs, which are usually not that risky. Equity is a mixed ball, however. But these two factors are the unique element in the Bay area, and why you should move there. If you are an engineer in the bay area without loads of equity or RSUs, you're getting ripped off.
This thing is so complicated and so full of magic and options and the documentation is so shallow, I can't find examples, can't get a tutorial that isn't uselessly superficial.

I've tried using Webpack in its begginings, because React people only talked in Webpack terms, but then switched back to Browserify, which is simple, not magical and straightforward. I tried using Webpack again lately, with the bizarre Gatsby static site generator, and the failures are enourmous. I can't even understand how exactly does a loader work. Gatsby makes forced use of something called webpack-config or something like that, which is just a useless abstraction on top of the already confusing Webpack config.

Please, someone explain to me what does this thing do that Browserify can't.
Even anarcho-capitalists, the most hardcore libertarians, believe heavily in the court system.

So I'm not sure what the OP means "without lawsuits". Because lawsuits would most likely be their answer here. Also maybe competition from other email vendors who take your security seriously and doesn't leak 1 billion emails? Or pressure from investors not to create that type of liability?

Pretty obviously a strawman, it's far easier to win such an argument with silly caricatures of libertarians as an opponent... someone who believes that all companies should be able to do whatever they want, without any consequence!

Only the most extreme niche of the already niche group of anarcho-capitalists believe in private courts or private law enforcement. Which does not at all reflect mainstream libertarian thought. Who instead wish for a "minimal" state, which at a very minimum means centralized courts.

I've heard economists argue that economies and societies do not exist without some form of a legal system (chiefs, kings, courts, etc). It's the very core of human co-existence to be able to resolve disputes in a fair and just way.
Contact me. My email is in my profile.
> I'm not certain this has been thought through sufficiently. If an organization is in a position to confiscate the camera from a journalist, they're almost certainly ALSO in a position to extract the encryption password from the journalist.

yes, autocratic regimes will default to a very easy method which does not require much training or skill: https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis
> this gets fixed

This being what exactly? What is a threat model you are talking about? Because it sounds like you think that a typical user account used for porn, social sites and hobby is worth protecting somehow to the extent of government involvement.
> there is no such thing as insurance for this type of breach

There is insurance. Some of the breached accounts likely contained credit card info, and any exploits are covered by existing insurance.

Some of the accounts might contain embarrassing emails, but few people have insurance against hacked disclosure of that sort.

Things like this happen because the public doesn't care. Most people who use Yahoo for email are computer illiterate and are more likely to do things that lead to a breach. They are also more likely to quit using the service if things like 2FA are required.

So in a sense, the invisible hand delivered the service that was demanded, and now the market can correct. Some percentage of the users impacted will learn from the experience and demand higher quality email hosting in the future.
10 articles to bring with you to a desert island
You can only rehash if you have the plaintext password

There are techniques to rehash, even without the plain-text password, and without the user having to login to trigger a rehash.

Drupal 7 used such a technique for upgrades from Drupal 6, migrating from MD5 to a salted sha512 hash, but it's not an uncommon technique.

The old passwords are stored as MD5 hashes in the databases. The MD5 hash is processed through the same techniques as new passwords: a salt and the new sha512 hash. Provide a way to identify whether the origin was a password, or an MD5 hash.

Either way, you end up with a hash. You can identify whether the origin was a password, or an MD5 hash, but you can neither determine the origin MD5 hash, nor the origin password, as the new hash is secure. So even if the original MD5 hash was insecure, the new hash is secure.

When someone attempts to login, you still need to determine which password-validation to use: hash = sha512(salt + password), or hash = sha512(salt + MD5(password)), but the security level is the same.
Yahoo says 1B accounts exposed in newly discovered security breach
But would it require users to change their password?

The way I would have implemented it, but would be keen to know how secure it is, is that you start with the md5 of the password (md5(password)). You then bcrypt or scrypt that md5 (bcrypt(md5(password))) and replace the md5 in your database with the bcrypt hash.

When a user logs in, all you need to do is to calculate the md5 first then check that md5 against the bcrypt hash you have stored.

I am not a crypto expert but intuitively it doesn't look like I would have weakened the security that way. You can't really attack bcrypt(md5(password)) much more than bcrypt(password). Can you?
I'd have to say that selectively keeping inconspicuous photos and transferring the "incriminating" ones via the internet (as suggested by others) seems to be the best possible course of action.

Aside from that it seems better to allow the authorities immediate access to all photos without encryption. You might lose the pictures but I think you'll have a better chance at avoiding personal harm.