skysight-inc/HackerNews huggingface dataset:
> How many people do you hear complaining that consumers are bearing the cost of seatbelts and airbags installed in cars? We're willing to pay the few extra dollars because we all know how dangerous it is to not have those things.

This is not so black/white. Car safety constantly becomes more advanced over the years and it has become a competitive feature of cars to get "best safety rating". So they still spend a lot of R&D money to stay at the top of the line, regardless of fixed regulation.

Often best practices come baked into frameworks that we use now, such as Rails being relatively "secure by default". Which makes adoption of them easier.

But at the same time cyber security evolves quickly too and software updates quickly underneath it, exposing new threats.

So I believe it will always be an R&D investment that will evolve and change over the course of softwares line span.

The question is about incentives. Car manufacturers have a big incentive to make their cars safe because people know how dangerous cars are and consider that as part of their high-dollar purchase. There is also a big consumer reports style industry around car safety to inform users. Also car manufacturers (and physical products in general) actually kill people increasing the liability of a broken product.

Most software lacks those incentives for a variety of reasons. Such as low cost barrier to entry, lack of understanding of security, lack of tactile differences, low time investment evaluating alternatives, low cost to publishers when hacks do happen, etc.

I'm all for the cyber security industry maturing and software security best standards being taught to every developer. But I don't think we have the costs, consumer understanding, or infrastructure entirely in place or figured out yet to have an optimal effect.

At the same time it's very possible it might remain a constantly moving target and be a larger challenge than most other engineering safety standards, like buildings or vehicles. Something to consider.
Good link! Looking forward to reading that.

I've been following your projects on Github for awhile, good work—I don't necessarily agree with all of the design choices but we've built on the eventstore at work and I'm going to be using it on another project in the near future.
Cisco seems pretty good about patching. There have been some controversial cases, but typically when I see Cisco exploits at a conference, it will start with, "If you haven't patched your routers to xx.xx.xx, do it now."

Do you have specific examples of holes that have existed for a long time without official patches or mitigation?
How's Accenture doing these days? (Not quite the same I know, but I did just discover today that Arthur Andersen relaunched last year, huh!).

In a fit of irony, multiple partners left the smoking ruins of AA to found a firm called, of all things, Accuracy.
Hi sorry for off topic question. But how do u feel about clojure ? I am a python developer and really interested in clojure. Do u think it's worthwhile learning ?
The stuff about RussiaToday is in there as evidence for the hacking because it establishes intent. They use it as a proxy for Putin's opinions.
Le Tote (YC S13) Is Hiring Ruby on Rails Developers
Hi there. First, you've got to begin with the understanding that no one is maintaining a list of federal .gov websites holistically (or at one I can get hold of). So, before scanning, we source several public datasets to gather potential .gov hostnames. This was recently described in depth by 18F [https://18f.gsa.gov/2017/01/04/tracking-the-us-governments-p...]. In addition to Censys, GSA's DAP, and the End of Term Web Archive data, our team performs authorized scans of federal agency networks [https://www.whitehouse.gov/sites/default/files/omb/memoranda...] and so we mine that data too. This currently nets ~90k hostnames, only which about a third are responsive.

For both hostname gathering and HTTPS scanning, we use 18F's domain-scan [https://github.com/18F/domain-scan], which orchestrates the scan and provides parallelization. We use the pshtt scanner to ping each hostname at the root and www for both http and https-- this typically takes 36-48 hours to burn through. Once the scanning is finished, we throw the data from the CSV into mongodb, then generate the report via LaTeX. The trickiest part is probably report delivery, which is a mostly manual process for Very Government reasons.

Most of the bureaucratic challenge is overcome because we've already been doing scans against these executive branch agencies for the past several years, so we're a known quantity, though we do modify our user-agent to clearly point back to us. On the whole, agencies have been very supportive-- the data on Pulse bears that out. Agencies really do want to do the right thing for citizens.
You're right, this is (unfortunately) very common. I wish there were clearer guidelines about this.

The White House Office of Management and Budget publishes IT policies, and they ask for specific URLs with www in front: https://www.whitehouse.gov/sites/default/files/omb/memoranda...

But I don't think they or anyone would care if the www redirected to the root, or vice versa, as long as it eventually got you there.
For migration of immutable events, there's a good research paper[1] that outlines five strategies available: multiple versions; upcasting; lazy transformation; in-place transformation; copy and transformation. The last approach even allows you to rewrite events into an entirely new store.

[1] The Dark Side of Event Sourcing: Managing Data Conversion http://files.movereem.nl/2017saner-eventsourcing.pdf
You sure about the user base count?

vim is a lot older and's got a lot more time behind it than all the alternatives you mention.
You mean "what can we do to further escalate this cold war that has previously brought both our countries to the brink of nuclear destruction".

Here is a proposal, let's secure our information technology and stop paying the NSA billions to actively weaken it or oppose secure systems as policy. Let us also in the spirit of the new year abandon this general obsession with global power projection and care more about what happens in Flint rather than Siberia or Mockba, I hear it's fucking cold there anyway.
Could just tell it like it is. I have yet to see this fully assembled in one place but it connects the dots pretty well.

Trump owes Blackstone/ Bayrock group $560 million dollars (one of his largest debtors and the primary reason he won't reveal his tax returns)

Blackstone is owned wholly by Russian billionaires, who owe their position to Putin and have made billions from their work with the Russian government.

Other companies that have borrowed from Blackstone have claimed that owing money to them is like owing to the Russian mob and while you owe them, they own you for many favors.

The Russian economy is badly faltering under the weight of its over-dependence on raw materials which as you know have plummeted in the last 2 years leaving the Russian economy scrambling to pay its debts.

Russia has an impetus to influence our election to ensure the per barrel oil prices are above $65 ( they are currently hovering around $50)

Russia can't affordably get at 80% of its oil reserves and reduce its per barrel cost to compete with America at $45 or Saudi Arabia at $39. With Iranian sanctions being lifted Russia will find another inexpensive competitor increasing production and pushing Russia further down the list of suppliers.

As for Iranian sanctions, the 6 countries lifting them allowing Iran to collect on the billions it is owed for pumping oil but not being paid for it. These billions Iran can only get if the Iranian nuclear deal is signed. Trump spoke of ending the deals which would cause oil sales sanctions to be reimposed, which would make Russian oil more competitive.

Rex Tillerson (Trump's pick for Secretary of State) is the head of ExxonMobil, which is in possession of patented technology that could help Putin extract 45% more oil at a significant cost savings to Russia, helping Putin put money in the Russian coffers to help reconstitute its military and finally afford to mass produce the new and improved systems that it had invented before the Russian economy had slowed so much.

Putin cannot get access to these new cost saving technologies OR outside oil field development money, due to US sanctions on Russia, because of its involvement in Ukrainian civil war.

Look for Trump to end sanctions on Russia and to back out of the Iranian nuclear deal, to help Russia rebuild its economy, strengthen Putin and make Tillerson and Trump even richer, thus allowing Trump to satisfy his creditors at Blackstone.

Sources: Time Magazine, NY Times, The Atlantic, The Guardian UK.
HN is clearly preventing any so called "election hacking" related articles to appear in the first page. Interesting.
I used to use wireless charging every day with my old Nexus 5, I loved it! I had a wireless charging puck at work where I would sit my phone on whenever I was at my desk, it was so easy that I could do whatever I wanted with my phone whenever and not worry about battery, ever (I also rarely needed to charge when I got home). I'm now using a Oneplus 2 phone and miss the wireless charging feature every time I need to plug in a cable, if I can, my next phone will support wireless charging again, I miss it so much.
> For example, even though the bitpacking from the post achieves fast good compression, it is unable to compress floats in general; merely 1.0 and 0.0.

Fewer bits does not always mean better compression, particularly if the data has other patterns which is destroyed by the packing.

With Apache ORC, I found out that if you bit-pack data to say 7bits vs leaving it as 8 bits, the 8 bits version compressed much more with Zlib than the 7 bit version.

This had to do with the data getting a bit offset into the previous byte sequence, until what was a sequence of repeating bytes turned into a pattern which repeats far less often.

Leaving the extra bit in place, helped Zlib dictionary encoding and huffman work much better than trying to save a bit.

The final kicker was that the 24 bit sequence was faster to read than a 23 or 21 bit sequence, but purely due to the fact that the word aligned stuff can be decoded in SIMD.

I'm no better at guessing what would work - "whatever works ... works, so try them.".
When dudes be like "just trust us", and they've lied before, and they have obvious interests in lying again, no it ain't everybody's favorite fallacy.
Google Home Hubs endless loop
LeakyReLUs often have very small slopes on the negative side; this can help solve the problem of no gradients getting through a layer because the activations were all 0. But I would say it still has a sparsity effect on a trained network because of how small the slope usually is compared to one.
Netflix IPs would make some great worlds for larger games, actually. I can imagine a Telltale-style narrative adventure set in the Womens Prison of 'Orange is the New Black' or an action horror game where you play as Eleven, trapped in the Upside Down. Even their animated properties - Knights of Sidonia, Ajin, and Voltron - would be awesome worlds for players to experience. Netflix, if you're reading, hit up the game studio I design for -- contact@phosphorgames.com
They really have zero sense of irony. Typical fascists.
I had no idea that soft boundary selection option existed. That's wonderful, thank you!
Tattoos on Math – 3Blue1Brown
Sysadmins at places I've worked have used "defense in depth" as an excuse to create layer upon layer of frustrating hoops to jump through in order to get any work done. I'm pretty sick of it. One perfect layer is vastly preferable.
Yeah, fair enough, but if you're not using ES then the names of messages don't matter a whole lot because you don't have to live with them forever.

(Edit: ok, they matter some, in the way names of variables and apis matter.)
Copy and paste it in. For some reason the owner redirects traffic from hacker news.
I'm not quite sure what you expect Ctrl-arrows to do, but I'd be surprised if tmux can't be made to keep that behaviour.

If you spend a lot of time in the terminal, there's a lot of value to be gained from using tmux. It takes some configuration to get value from it, but there is value there.
2. This sounds off to me. Imagine if a restaurant's menu said they don't know where their ingredients come from or what they may actually consist of - that's probably true a lot of the time, but it makes the customer wonder why the restaurant brings it up but doesn't do anything about it...
>the freedom to publish anything

Including libelous material?
Looking at the charts in the report it's impressive and worrying at the same time to see that the media influence of RT is in the same league as BBC, despite nobody heard about RT just a few years ago, while BBC has existed for decades.
Or you put a USBC-Thunderbolt cable in the new macbooks box
My solution is we prosecute botnet operators and malicious actors. We have the technology. The NSA has the ability to know who they are. Countries that harbor them should face sanction.

And ISP's could stop this DDOS activity. We should police this at that level. A system where when a DDOS is reported by a reputable web hosting company or service provider to a system that ISPs belong to, could stop DDOS in its tracks.

Enable 2 factor auth at the ISP level. If a report of DDOS comes in, send an SMS to the authorized user of the account.

And punish companies that perform bad security in the marketplace. We are getting more tech literate as a people, as a society. The market might not be fulling pricing in security right now, but the issue is new and awareness is just beginning.

Lets be clear, this is selective enforcement. D-Link is one operator, using what were very common practices at the time, and still are.

No one who created these devices was ever told that these practices were illegal, or would result in sanction. And now we are fining them. D-Link will weather this as it is big enough. But small operators wouldn't.

So the result of this government action is that startups and crowd funded projects are less viable. Now, startups and kickstarter projects need to have a line item in their budget for security insurance. And an insurer has to take on this risk. Because it wont be policed or litigated evenly. And thers no telling what the security standards of tomorrow will be.

So startups will have to buy security insurance. And that will be expensive.

Big companies will survive. They will be able to pay the protection fee, the extortion fee. The status quo will remain. We won't be more secure, because the real actors making us insecure are nation-states and Chinese manufacturing.
Thanks for posting this! I've had the same concerns for a long time, so I'm very glad that people are working to solve it.

If this takes off, and some kind of digital signing is introduced for reviewers to seal their approval, it could finally be the end of the broken paper-magazine business.

A pity that the team's based in NY and doesn't seem to be open to remote work.
Eh? I've had 3 Angular contracts in a row, the most recent started a couple months ago. Indeed shows over 500 openings in Chicago. I get the burnout, though. JS frameworks are just exhausting. I've been browsing Rust docs for the past hour, wondering if a side project would make the burnout better or worse.
This made me think of an old gig I had. It was a sort of so-easy-a-caveman-could-do-it tech support job. They actually had us printing out a report from an HTML document, cutting out portions that weren't supposed to be there with scissors, and then photocopying the cut up page to get a final report to mail out to the client. I'll let that sink in...

It didn't take me long to start editing the HTML document directly to skip the physical work (someone before me had figured this much out, but hadn't been able to teach anyone else well enough to pass it along when he left, just a vague rumor that it had happened). Then I went ahead and made a crude script to edit the documents automatically, ultimately turning an hour long job into a 2 minute one with cleaner looking results. Ended up spending a lot of time at that job just watching TV.

My next job after that was all about automating manual processes, but with less down time since I was automating other people's jobs, rather than my own. I think I preferred the former.
It is part of the MFi program.

What would you like Apple to do?
Fun. I wonder why they went with a modern-day chinatown backdrop for Marco Polo. I haven't seen season 2 yet; did this somehow become a time travel show? :P
> I simplified Pieter's story to fit the narrative I thought I saw. I was blinded by what I thought sounded like a good story. So when Pieter said he had stopped traveling temporarily, I simplified that to "He stopped being a nomad."

These are the key three sentences which betray the whole ballgame.

He bloody said temporarily. You damn near libeled the subject by changing that to your narrative. One is a temporary decision and the other is a complete lifestyle change which, oh, by the way, he has built his entire life and brand around. His alleged lifestyle change was the whole basis of your story. I'm amazed Quartz didn't retract you. This seems open-and-shut retract and rereport to me, but then again, I'm not editing Quartz and I don't have all the information.

Why are you able to feel that you missed something now? Why did you miss this during your reporting? Did you not ask the right questions? Did you pull a Erdely and write TO a desired narrative with the thinnest of support? Every answer arrives at you and is troubling, especially that you're so willing to engage the subject in public to the extent that he blocked you. You're arguing with a subject and trying to skirt his blocks in a public forum. Step back for a second and think about that; your value as a journalist is solely what information you can develop from your sources, and why would anybody source for you after this?

The tone of your self-promotion itself already gave me pause that you are pursuing journalism for the wrong reason. You have a worrying penchant for muddying marketing and journalism, and that your first hero piece was taken as a hit by the subject only reinforces that.

I don't know if I'd compare you to Glass yet, but my Erdely bells are ringing while reading all sides. There's nothing wrong with being a marketer, which seems to be your skill set and that's fine. Be very, very, very cautious translating that to journalism, though, especially since you're a few bylines in, ostensibly without training, and explaining journalism in the comments here. And blaming deadlines for grievous journalistic missteps. And claiming this sort of reaction from a subject is common for profiles. All of this greatly concerns me.

> Please stop writing mean things about me and making me feel bad.

The irony.

Also, if one subject of one story got under your skin as far as you have claimed, abort journalism as a vocation immediately. You are going to destroy yourself when the stories get bigger and controversial. Your first death threat is waiting for you in the future, so either steel yourself to the opinion of others or accept that you're not cut out for it. Imagine if you had recently "gone pro" and were assigned to the Trump campaign.

(Former short-lived investigative journalist. I was sent a link to this comment section by a metro editor with some unkind commentary added, by the way, so your self-promotion might be slightly backfiring.)
But now it's 'this year'.

Actually, wasn't it 'this year' last year? I thought they were saying Q4 2016 early 2016.
Oh yeah, us too. We use CQRS on nearly all projects we do these days. But event sourcing, totally different animal.
Because you refuse to distinguish between an attack on your mind and a good-faith but imperfect attempt to share genuine information. These are two very different things, and treating one as the other damages your ability to reason about the information you get from that source. More insidiously, it is likely to lead you to treat everything as somewhere more towards the middle of the two than it actually is (e.g. "everything is propaganda, but it contains some truth I can glean and some parts I need to reject"), thus offering an "in" for the dedicated attacker while refusing some good information that could help you course-correct.

More broadly, it serves to normalize propaganda by treating a deliberate attempt to trick us as if it were the same thing as an honest but maybe imperfect attempt at sharing information.
Do ad networks allow doing this?
The irony of Hillary losing because of some kind of interference by Putin is that he's only in a position to do so because her husband and other Americans interfered in the Russian presidential election 20 years earlier in support of Putin's mentor, against a Communist Party that was virtually certain to win (and by some accounts did). Nobody seems to be losing any sleep over that one though.
It's "intellectually dishonest" to doubt the existence and alleged content of material we'll never see? That's Orwellian.
I didn't even realize my (iTerm2) terminal emulator wasn't fast until I tried Alacritty. When doing non-intensive tasks, the difference is less one of vision and more a "feel". And it feels SNAPPY. And, as a heavy tmux user, I'm definitely your target audience.

But...the font rendering doesn't look as good as iTerm's, at least not yet.

I suspect I'll be swapping once you're at a public build release.
The underlying premise of what you write, seems to be that money is the only yardstick that matters. That is why you patronisingly write that there is a very long line of people between Mark Zuckerberg and DHH who are "winning at life", even though the reason I referenced Mark Zuckerberg specifically was that he seems like a rare person who succeeds in business and apparently manages to balance that with the rest of his life (hats of to him for taking 2 months of paternity leave). It is why you dismiss the notion that the people who worked hard on a failed product, could have anything to be sorry about as long as they are still able to get a high paying job in the next hot startup. And its why you disregard the part of DHH's criticism that doesn't talk about whether or not your business will stand a smaller or greater chance of "making it", but warns about how dissatisfying it is to be a founder and not have total control, and about how the pressure to strike it big or go busto sucks all the fun out of having a business.

Which is fine, I guess, and certainly explains why you wouldn't be impressed by someone like DHH. I for my part find DHH's opinion both interesting and refreshing.
And yet what you're "doing" is letting your anti-establishment tendencies do Putin's work for him.

This is starting to look a lot like some relationship drama, where the mother-in-law constantly sabotages the marriage with tiny annoyances and seeding doubt. "Did you leave the milk carton outside the fridge?". "No, but didn't your husband have coffee earlier?".
Well, you should be only registering .io domains anyway ;)
I got an F.

I should probably update things.
I've done it with about 5 dollars worth of hardware (total for both Qi emitter and receiver), and it was a bit fiddly to place the encased phone on the charger in the right place, but no luck was actually required.

https://www.aliexpress.com/item/100-Original-QI-Wireless-Cha...

https://www.aliexpress.com/item/Qi-Wireless-Charger-Receiver...
How old would the radio signal be by the time it reaches us?

Edit: the answer was more obvious than I assumed :p, looks like our earliest AM/FM radio broadcast 110yrs on it's way leaving the milky way http://www.lightyear.fm/
Is HN really this pro-Trump or are the Russians here?