skysight-inc/HackerNews huggingface dataset:
I think "free market types" understand and accept that the world is a messy place, and that human organizations cannot generally be trusted to consistently do what they claim. ("Your information is safe with us", etc.) I believe that this is due to fundamental properties of human nature and group psychology.

I believe that there is no general way to create near-perfect accountability for the statements of people, and that the second-best option is to embrace the uncertainty and develop a finely-honed sense of risk assessment.

It sounds like this is the underlying concern -- if you are unable to appropriately assess risk, and you place your trust in an organization that then betrays your trust, you feel violated and want to work toward preventing that sense of violation in the future.

You could do that by working to hold organizations accountable through regulation or other means.

Or you could improve your ability to assess risk, and consciously and deliberately accept risks as they come. When the inevitable adverse event happens, you understand that you consciously accepted a risk in the past, and appreciate the opportunity to refine your own personal ability to evaluate risk.

So, I don't agree that this is something that needs to "get fixed". I fully expect that my basic personal information is poorly secured, and I consciously accept that in exchange for the benefits of participating in our current society and using the current services offered.

It's easy to say that "we need better information security", but every decision has a tradeoff. Increasing security fundamentally increases costs, slows the flow of information, and creates less nimble organizations. Many of the services you expect to be available -- Uber, cheap IoT devices, whatever -- may simply not exist in a world where a "proper risk assessment" and "tangible cost" of information breaches are applied.

You, of course, are free to spend your time educating the public about information security, or how corporations can't be trusted, or even lobbying for information security regulation. That's what makes Earth fun and interesting -- everyone's following their own passions!
> 80% of entrepreneurs are sole proprietors or partnerships

This seems interesting but makes complete sense. Most ideas likely won't pan out and incroporating usually isn't worth the time. I'm in Colorado and making a c-corp took all of 15 minutes, but I've been told in other states its a huge proccess. If it wasn't so simple and I didn't have free legal support, I definitley would not have done it.

https://stripe.com/atlas/guide#incorporation
The method I've used is to add the column for the new stronghash then you update the old column to stronghash(<oldhash>), where <oldhash> is dumbhash(password) check against that on login stronghash(dumbhash(password)) and generate just stronghash(<password>) while you have the plaintext password in memory and update the row to add the new hash (simple and interoperable, not dependent on dumbhash) and drop the stronghash(<oldhash>). After a <longtime> limit (to optimize both maintenance overhead of the additional column / behavior and limit exposure to only minority users that haven't logged in for <longtime>), you drop the stronghash(<oldhash>) from everyone and do a "we sent you a reset email" for anyone that's trying to log in but has no <stronghash> password hash.
> I hate Google's mail interface

Their IMAP interface is both standards compliant and fully functional. I'm not terribly fond of the Gmail web/native apps either, so I just don't use them (though I do occasionally hop on the web app when my client isn't searching the email as effectively as google does).

With 2FA it can be a bit more work adding devices, but it's not a deal breaker for me.
Just sent this note to Tesla Sales:

Please tell your CEO that he needs to focus on one thing at a time. Delivering the Tesla Model 3 as promised should be his ONLY priority. Activities such as serving on a Trump economic advisory panel or thinking about solar shingles are a distraction and a waste of his valuable time.

Thanks,
Craig

(Model 3 reservation number xxxxxxxx)
(Plethora Founder/CEO here)

While definitely a good point (restrictive CAD keeps you out of trouble) the issue you have is that most companies want canonical CAD files living inside Solidworks, etc. and don't want to go back and forth. It's a lot of extra work, and people aren't switching to just using their CAD package because it's not feature complete like a commercial package.
It's unpredictable in the sense that even with a compile-time check that the function I'm calling is pure, I don't have any guarantee that it won't throw on my particular inputs.

This comes up a lot in the Haskell community -- code outside IO is guaranteed by the compiler to be pure, but you can still get hit with an asynchronous exception because you called a partial function.
Yuri Sagalov interviews WePay’s Bill Clerico
Complex?!

It's easy as hell. Even PHP, so often flamed for "bad security" these days supports EASY functions for this (and polyfills are available, if you're running PHP < 5.5, which you should't do anyway):

- password_hash, which creates a salted hash (the returned value consists of a type/strength spec, the hash, and the salt)

- password_verify, which verifies a password with a hash in a timing-safe manner

- password_needs_rehash, which tells you if you should update the hash in the database

password_hash and password_needs_rehash take a parameter for the hash function (currently only bcrypt is supported, quite likely to keep people from using md5/sha1), and for the cost (the amount of hash function calls).

I believe any reasonable programming language these days has such functions.

What I am NOT so sure about is how the various LDAP server implementations, which many people use for SSO and "normal" account management (because it's easier to connect a new software to LDAP than to migrate existing user db's into LDAP), handle password storage. I mean, having an LDAP server for the credentials prevents any form of password leakage, but in case someone breaches both servers/the LDAP daemon is running on the same host as the webserver?
Beyond GPU Memory Limits with Unified Memory on Pascal
The forged cookie attack was used on a limited number of accounts, by a state sponsored actor. Going to this amount of effort and then sending spam would be on par with breaking into a bank just to steal the printer paper from the office.

Most likely either:
1) you were phished and didn't realize it
2) logged in to your Yahoo account from a device that had malware on it
All hash functions have collisions. The point is that a good cryptographic hash function makes it very hard to find collisions.

The “preimage attack” on a cryptographic hash function tries to find a message that has a specific hash value. That is, you lock down a hash value (the MD5 hash for a password) and try to find a message that hashes to that value (the original password, or any other input that happens to have the same hash).

The best known preimage attack against MD5 has complexity 2^123. It's better than brute forcing, but still unpractical. Thus, if I come up with a good password that is long and random, you will have a very hard time coming up with a string that has the same MD5 hash value.

The practical attacks against MD5 are collision attacks. A collision attack tries to find two messages with the same hash value. With MD5 in particular, there's a chosen prefix collision attack, where you choose two messages and append to them so that the hashes will match. This was particularly devastating with X.509 signatures and certificates, where the attacker could have the MD5 hash signed by a certificate authority, and then use the same signature with their other message that has the same MD5 hash.
Likely obviated by their EULA
Or $year.A and $year.B
Downvotes are not limited to inaccuracy; a post can fail to add value to a conversation without being inaccurate.
WarmPlace is where the boundaries of mobile music are being pushed back
Have they stopped? ;-)
I think the organization as a whole is just indifferent. Does this breach really matter to Yahoo's bottom line? They were already sold to Verizon. Most of the active users probably won't read this news. It's sad to say, but I think Yahoo as a whole just doesn't care about their users.
Ah OK, thank you. Yes lets hope it arrives soon.
Uber self-driving car running a red light captured on dashcam
This is bad for Women tech CEOs in general. None of them seem very good.
> Then we would have come full circle. A markup language that has been at least inspired if not derived from decade old usenet/mail conventions would be back where it started from.

Is this a bad thing?

> Are you sure? The advantage of text/plain in mail is that I see every link as it is and no resources are loaded from external sources.
> With markdown support in mail clients, we might be back at early HTML support. Link destinations would be unknowable again.

Not seeing how link destinations become unknowable. With no scripting there's no way for a site to hide the destination, it is what it is. Your viewer can choose to display it however it wants. Status bar like a browser, tooltip, whatever.

> If it's not plain text, it has to declare a mime type (how would the mail client know how to render it?) but I don't think plain text section is mandatory.

It is though. That's a major advantage of Markdown, by adopting those well-established mail/usenet conventions where practical and attempting to follow that sort of principle with less defined formatting there's not really anything lost if you treat it as plain text. The other way around is almost as safe, with very little chance of a a plain text message treated as Markdown being misinterpreted in a way which significantly impacts its meaning.

> I know of no mail client that isn't able to handle HTML.

Any text-mode mail client? I mean sure there are some that can interpret basic HTML formatting and translate that to control characters for a sufficiently capable terminal, but modern HTML mail tends to go far beyond that. Basically what formatting a text-mode client can actually handle also happens to be the same formatting that Markdown supports. No images, no fonts, no colors, just paragraphs, links, quotes, and some basic emphasis formatting.
Chiming in to respectfully disagree that New England winters are better than Seattle's. Seattle has a more temperate winter with fresh powder 90 minutes to the east, if you're into that sort of thing. Snow should be on a mountain with ski lifts, not in your driveway :)
Gonna guess that's a bad message for a password length violation or something else.

Not that it's much better. Is it so hard to allow 50 character passwords?
Chatbots are awesome for two reasons

1. Moves away from emailing a company. Just think how many people today are messaging the facebook pages of companies instead of writing these long formal emails to get something. Conversational explaining just ends up being much faster and more convenient for many people.

Look at the overall shift between phone calls -> text and internal business emails -> im/slack

2. Most non-technical people have trouble even being able to interact with a computer (somewhere between 60% - 80% of people still don't know how to google what they want and get it on the first try), moving to a conversational system (if it works right) can rapidly increase the amount of people you can interact with.
www.directlabs.com has it for $59
They also run promos time to time.
I have no affiliation.
Though I would expect this test to be covered as part of your physical but check your insurance etc.
True, however, it does put SOME price on data collection, rather than leaving it in the realm of pure externality. The deterrent of cost is the benefit, not the protection itself.

On the other hand, adding a price may embolden deep pocketed organizations to 'pay to absolve' for losing data to hackers on an ad hoc basis as a cheaper alternative to strong security and limiting data collection scope. In that case, the impotence of ID theft protection hurts a lot more.
UNsalted anything has been phased out earlier in a lot of other places
With my proposed version scheme, you won't ever get 54.32.593.3. That's kind of the whole point. So instead you'd be comparing 1.2.1.1 and 1.3.0.2, which is a lot easier to read.
Is netsil oss?
Go with the flow: Institute a highly profitable vomit fee, and offer a VR headset for the passengers to wear during the ride, to increase the chances that they'll throw up.

http://www.economist.com/blogs/gulliver/2009/10/what_price_v...

"I'm a vomit-bucket-half-full sort of guy. I don't think these cabbies are trying to charge you for puking, I think they are offering you the premium service of vomiting in their taxi."

"America was built on the idea of premium services. This is how the wealthy are able to have so much more fun than everyone else. They can behave however they want as long as they have the money to cover the premiums! The $70 currently in my wallet entitles me to a good three blocks on Michigan Avenue and a nice half-digested deep dish pizza projectile vomited all over the headrest."

http://uberpeople.net/threads/throw-up.630/

"Yep Uber is pretty good here in Sydney as well. I had the outside of my car given the Jackson Pollock chunky rainbow look by a passenger. His friends thought it was a real laugh and afterwards I found they had also taken my giveaway chocolates as well. Sent the report in with photos and $95 receipt for the cleanup, and got $250 credited to my account the very next payment.

I have to say, in all my years of driving public vehicles Uber (with its hold on the rider's credit card detail) , have the best and quickest method to compensate drivers for these horrible incidents when they occur."
not sure that would work really - could lead to falsified medical records to claim from state/drug abuse/(falsely) claiming mental illness in an attempt to absolve people of crimes in court etc
> Receive comments about your choice of font for the powerpoint.

That would be 2.5, they will be unsolicited, and yes, your font really is too small.

2.6 is where you spend another five minutes faffing about with the font size until everyone is happy.

(which is why I rarely use slides and even more rarely put any text in them)

(but if you're demoing anything on a computer screen, the same applies)
So, where is all the real work being done?

Oh, that's right, by THREE.js inside the normal WebGL API.

This is just a fancy way to execute a banal-ly simple 3D scene that takes a single parameter - what text to show. It doesn't do much and I don't see any useful abstractions for the usual 3D primitives and doesn't meet the requirements of 3D programming in general.
I only code in Go these days and it has become my default editor.
Especially about it being a bad idea to make people regularly change their passwords!
I don't think that's true.

This site from 2006 claims they could find collisions in an average of 45 minutes on a 1.6 Ghz Pentium 4: http://www.bishopfox.com/resources/tools/other-free-tools/md...

If you account for speed increases over the last 10 years and assume the password thief has access to a botnet, then it wouldn't surprise me if they've found collisions for the entire list.

Edit: Nevermind, the link finds two strings that hash to the same thing; it does not find a string that hashes to an existing hash.
On a number of engagements I've come across password databases that have been migrated to bcrypt. In one case I checked CVS to see who made the code change, and found the MD5 passwords on his dev box. In another I tracked down a MySQL slave that had broken replication for over a year.

In both cases I tried to track down backups, but discovered neither company was keeping them. That is another possible vector.
Being able to hide the activity bar puts VSCode into a class of editors I could imagine myself using. I tried it a couple of times in the past, and that damned big ass bar of useless icons bugged me too much (I work on a laptop screen 95% of the time, so giving up that much real estate for something I'd rather do with hotkeys is just painful). It sounds silly to dismiss it over such a small UI thing, but well...my screen is small, my eyes are getting older (so even though I have a 4k display, I can't shrink everything down without eye strain), and vim and Atom don't eat up the screen in the same way. So, I use vim and Atom (mostly vim, as old habits die hard). But, will give VSCode another try.
How about... let's leave it alone? If you don't like it, don't use it. I like it.
If I understand well, in the US, everybody is sole proprietor by default and you don't need any agreement from the government to start your personal business?

In France, if I plan to earn any money from a website I built, I need to create at least a "micro-entreprise" [1] to declare my income (up to 32,900€/y for a SaaS).

[1] https://www.service-public.fr/professionnels-entreprises/vos...
They can have 17 years of junk mail as that's all I ever used yahoo for
Moxie et al, Axolotl, Proteus and legal stuff
Agreed with everything, but bear in mind that producers are basically business managers; they're not that interested in the technical arguments but in minimizing their liability towards investors if things go bad on a project. Every producer I've ever worked with has been very conservative about innovating on workflow or depending on anything too non-standard because they don't want to be held hostage to any individual crew member, and workflow problems have killed many a project in post-production.
Hot exit is still useful when auto save is on as it works with untitled files. Crash recovery also comes with hot exit regardless of whether the feature is on or off. (I'm on the vscode team)
I don't trust any company to not send me spam. Even if they don't do it today, they may get bought-out, hacked, or otherwise lose control of the data. Even if everything suggests that they won't spam me, I'm not entirely convinced. Even if they're the most upstanding company on the planet, I'm still not convinced. Based on past experience, you understand.
Too DRY – The Grep Test
That is fairly easy to fix, though. Add N to the size value you get until its non-negative.
I don't understand the intent here. What am I building that's a browser VR experience? That's as foreign to me as saying a browser cooking experience. Those are words, but I just don't understand how they'd operate together in a way that would be enjoyable and easy to use.
PlushCare, Inc - plushcare.com | Fullstack | Fulltime San Francisco, California

At PlushCare, we believe in helping every individual achieve health and happiness. We believe through the use of technology, we can create the ideal healthcare experience. Simply put, our mission is to challenge the status quo by providing every person convenient and affordable access to the best-trained doctors in the country. We allow patients to skip the waiting room and get diagnosed, treated, and prescribed medication by top U.S. doctors via smartphone. We're looking for people to join our team to help bring healthcare to the next level.

Interview Process: 30 min phone chat w CTO, a coding assignment (~1hr), and a half day onsite
Culture: Super fun, collaborative team. Everybody here shares the same ambition to make healthcare more transparent.
Feel free to shoot us an email at careers@plushcare.com for more information.
https://news.ycombinator.com/item?id=13180033
There's `webpack.LoaderOptionsPlugin` which allows backwards compatibility, generally solves the problem.

One word of warning: LoaderOptionsPlugin _may_ mess with "context", so you should always redefine it in each plugin option object.

For example, using PostCSS without a .postcssrc:

// postcss hasn't yet started to use options within rule definitons of
// webpack 2; instead, we use a LoaderOptionsPlugin which provides
// webpack 1 support of options to postcss.
// https://github.com/postcss/postcss-loader/issues/92#issuecomment-251439696
new webpack.LoaderOptionsPlugin({
options: {
// See https://github.com/postcss/postcss-loader/issues/99#issuecomment-248878925 and
// https://github.com/webpack/webpack/issues/3018#issuecomment-248445176
context: __dirname,
postcss: [
require('postcss-mixins'),
require('postcss-simple-vars'),
// TODO: Remove and use css variables (http://cssnext.io/features/#custom-properties-var)
require('postcss-constants')({
defaults: defaults
}),
require('postcss-each'),
require('postcss-cssnext')({
browsers: 'last 2 versions',
features: {
// https://github.com/robwierzbowski/node-pixrem/issues/40
rem: false
},
import: true,
compress: false,
messages: true
}),
require('postcss-nested'),
require('lost')
]
}
})

You can get around this by using a postcss plugin to read from the common config file (.postcssrc iirc) also, but I depend on requires for postcss-constants so couldn't.
What if I'm working on a side project, don't want VC funding (or any sort of loans), and just want to build organically? I can find people who can program and can program well in almost any place on the planet. There are a shitload of Russians and Chinese cleaning up at things in the software engineering domain. There are a shitload of people writing all kinds of good and bad code everywhere. Even if I wanted to found a startup in Nowhere, Saskatchewan I could, particularly since there are plenty of folks who will work remotely and maybe a few locals who are good as well.

San Francisco is a place. Engineering talent is available everywhere, though perhaps most places it isn't so much fish jumping onto the line as in the Bay Area.

What about all the nerds who are Polish, Portuguese, and Peruvian and choose to remain local because their spouses, children, and other interests are? They can still code, some of them are definitely brilliant, and they can either work locally or (more likely) remotely.

Starting a "startup" with venture capital might be next to impossible in Peru, for all I know, but a hell of a lot of folks don't want to exit, don't want to dilute their ownership of their product, and frankly like the environs elsewhere.
If you commit whenever you complete a feature, or fix a bug, you'll quickly see the benefits. You can look back and see exactly why you made a change, or where you introduced a bug. And the best feature is being able to make a branch for dev (or each new feature you are adding), and be able to switch to master if there's a bug you need to fix.

Also, if you work with more than one person, committing early and often is invaluable.

Really, Git takes like an hour to learn. You could also just download tortoisegit if you really want to be lazy about it.
and already some discussion on HN: https://news.ycombinator.com/item?id=13180172
Have cameras take pictures of the interior before and after each ride. You then have a verifiable record of what state the car is in, and you don't have a bunch of data-privacy issues around recording activities while someone is inside the car.
Definitely. But I have come to appreciate a sprinkle of magic, especially if you can say show how the magic transforms something into something else that happens to be more verbose.

Hibernate went through this too. I came to prefer myBatis, but going through JPA is nicer. JPA is certainly not less magical than Hibernate though, just the culmination of many years of work in this area.

SQL Alchemy is also nice like this. The magical ORM is built on an extremely robust and well-documented relational database querying library. There's an escape hatch to reality if the magic fails you, always. Can't say that about Hibernate 3—see the HQL/Criteria API madness (again, fixed in JPA).

I went through a very hyper-annotation period with Java. I have since calmed down. I still make annotations, occasionally, but I don't let them be the only route to the work. Always have the annotations help something build a configuration through a standard API, then the work happens against that configuration. You can ditch the annotations if they're a pain that way, or bridge between something else (XML probably) without writing the same code twice.