skysight-inc/HackerNews huggingface dataset:
Disclaimer: I work for Uber. These questions/opinions are entirely my own as a curious engineer.

> These secrets belonged to a lot of different 3rd party services, for example Uber’s secret which can be used to send in-app notification via the uber app.

In every Apple application - aren't these keys a one off, created by the client?

"The device token included in each request represents the identity of the device receiving the notification. APNs uses device tokens to identify each unique app and device combination. It also uses them to authenticate the routing of remote notifications sent to a device. Each time your app runs on a device, it fetches this token from APNs and forwards it to your provider. Your provider stores the token and uses it when sending notifications to that particular app and device. The token itself is opaque and persistent, changing only when a device’s data and settings are erased. Only APNs can decode and read a device token."

Source: https://developer.apple.com/library/content/documentation/Ne...

If it is only your own token/secret you are seeing, that does not seem so bad, right?

In addition - let's say these apps DO leak secrets, what is the alternative solution here?
I'm not sure sponsored content is better.
Installing 10 other services doesn't seem like a good way to run a secure mail server.
Hardcoding your AWS stuff is nasty, because any bored script kiddie can extract it and make spurious requests, and at the end of the month you receive a larger-than-usual bill.

But Twitter API keys? These just allow access to the Twitter API. If these are leaked, the biggest risk is a denial-of-service of rate limits by a third party, which Twitter may catch and revoke the account. The developer will then have to create a new credential and update the app for it to keep working.

In this day and age where mainstream apps update often too, I doubt this is seen as a serious risk, for the long tail of apps. If this approach obviates maintaining Backend-as-a-Service proxy the developer pays out of their own pocket, it can be more cost-effective.
This is the last answer of the StackExchange's moderators: "It seems you have misunderstood the purpose of this site." So I gave up!
President Obama visited Moscow as he met with President Medvedev and President Putin.

This is at least innacurate.
How to Create Perfectly Centered Text with Flexbox
the opposite. No one reports to that employee. (my previous message was confusing sorry).
No. As someone who has spent five years programming computing clusters, I have seen many problems that are fundamentally hard to parallelize. If it falls within mapreduce you are basically "done" no matter what language you use (no need to argue fp vs imperative) but very many interesting problems to solve doesn't.

I am a big believer in FP too, but for other reasons.
Hop.js: A multitier JavaScript
Apparently in 2009 Obama visited Moscow and managed to meet both president Putin and president Medvedev. Granted, it is sometimes hard to remember who of these two is a president at any given moment, but a two-president state is a bit pushing it.
> My point is: Can a function call fail in Erlang, i.e. can it just "not return"?

Kinda? Function calls in Erlang are intra-process and synchronous, but the function could send and receive messages internally and never return because it never got a response and did not have a timeout setup.

When you're talking about actual messages between processes though, they are asynchronous and they can get lost (if only because the process you're sending a message to is on an other physical machine).
I think there's some truth in that. Unless the number of activists and good people increased, and the number of bullies decreased (which I think is more of a constant in a given society), the bullies just use whatever cause is more convenient in the present as a means to club other people with and/or promote their personal brand (that said, depending on their area and the general sentiment there, this could be, against just as well as pro gay rights, for example).
Sure, but those are (IMO) pretty clunky and broad-stroked compared to OTP, which handles quite a bit of that (and then some) on a much more intelligent and fine-grained level. Microservices are probably as close as one can get to matching OTP without basically reinventing OTP, and microservices often involve a lot of complexity (that's often in turn managed by tooling around things like Docker, but still).

OTP is also not tied to a certain cloud provider; a couple of Raspberry Pi boards duct-taped to a WRT54G can use the same codebase, deployment practices, and application structure as a bunch of EC2 instances in a VPC with an Elastic IP. This is usually not true of "cloud" tools (things like Docker and Cloud Foundry are helpful here, granted, but a lot of the tooling around load balancing and such is often provider-specific).
People’s Trust Has Declined in Business, Media, Government, and NGOs
Adwords used to work really well for me, over the years the return declined and the system got more complex until it wasn't worth the effort anymore.

There is a good post from Andy Brice on this: https://successfulsoftware.net/2013/05/26/the-declining-prof...
What good can we get from fake news
New AI to help understand documents faster and better
The only way i can think of would be to return the API keys with say a login request and store them inmemory until the app closes.
AWS secrets and other keys found in decompiled Android apps
ADDRESSING LOCALIZATION CHallENGES AND SPECIFICS – SOFTENGI’S EXAMPLE
That is hilarious.

I remember when I moved to a new apartment once, two of my friends told me how to get free meals. Every time they moved they wrote several restaurants about their terrible experience, how their staff was unprofessional and how they were embarrassed brining their relatives there. They'd get like 15 free meal vouchers for Chili's, O'Charlies, Red Lobster, etc.
Now that all make sense... The acqui-hire situation is another topic. Millions of dollars are spent when it comes to people acquisition. And indeed, companies are usually willing to get what they need no matter what. Any random software engineer with 10 years of exp can't get that in the valley by applying at Google. That would cost Google a lot of money... Plus, there's no real negotiation when you sent out your Resume asking them to hire you... they have full control. You might get a 10k sign-on bonus just by asking. That's it
Hmm. I'm not sure I'd want to rely on NodeJS for something as important as a wiki, also I see it uses MySQL if you don't want to use SQLite - but does it support PostgreSQL? Also can you use Markdown? Personally I quite like GitLabs built in wiki which while basic is great as you can just clone the simple git repo which is purely markdown files which is lovely to distribute around various machines, you can also gem install gollum on your local machine and have a git version controlled, offline markdown editor interface that can commit back to the central repo.
A simple pie chart in SVG
Despite not being an egregious case, I think the flagging's fair.

As others pointed out [0], the article's premise is silly and just an annual refresh of Oxfam's dubious statistic. Thus, WRT HN's submission guidelines, the article's off-topic and not "evidence of some interesting new phenomenon."

[0] https://news.ycombinator.com/item?id=13407849
Here's another nifty visualisation - this time with drone strikes:

http://drones.pitchinteractive.com/
What's fascinating is how little we can study octopuses at the moment with even the current technologies we have. Truly fascinating read. Thanks!
Lisp In Small Pieces by Christian Queinnec
What's a weird parody about it? That's different from being unofficial.
Will you cover anything about LuaJIT's "NaN-coding"?

Or perhaps do you have a link about how it works?
Are you going to share the links once you're done?
I had a similar experience when I tore my ACL; I still don't really feel comfortable going down stairs (up is fine for some reason) even after a very successful surgery.
this doesnt work for collisions
Never had that happen to me in over 35 years of riding bikes. I do go over the handlebars occasionally. I have had the front wheel slide from under me a few times as well (my least favorite way of falling). I even ride with a low tread back tyre so I can slide the back wheel around a bit on trails.
He did not actually make that assumption.
>Does Google actually punish sites for buying spam SEO, or is this speculation without evidence? They don't publish page rank scores anymore, so how can one know?

Because they tell us:

https://support.google.com/webmasters/answer/2648487?hl=en

>How does one determine their site is "punished"?

Because it suddenly falls behind in results?
"Websites love talking about how much their readers are cheap, and how, no, they don't publish crappy content, they would totally check facts and whatnot.

Let's be honest - many websites are after monetizing whatever they can. They want content cheap to produce. And if readers don't want to buy it, they'll sell your attention and your privacy to advertisers, until eventually it's a race to the bottom."
I stopped getting all my satisfaction from code, computers and tech. Exercised, took up some hobbies, particularly those outdoors. You can work a normal job somewhere and it's perfectly fine (at least for a while) -- the money is good and you can do a good job.
That was just the kernel. There's a classic book by Lions adding commentary to the listings.
You ask this question, but it seems like you don't know how the real world works.

In a lot of places, you aren't asked to build a product. Especially if your core isn't technology. You are on a tech team that exists within the structure of a large organization that really doesn't care about technology at all. It's just a thing they want on a check list.

So you get asked to throw something together to see if people like it. So you do. And you don't in your wildest dreams think that this piece of shit is going to see the light of day. It's just concept.

And then the next thing you know, some assclown decides it's good. Okay great. But you didn't hear about it because the company is the size of McDonalds. Not a small startup with 6 people who all know what they are doing.

So ops and infra get together and deploy this toy shit that you thought was just a joke mostly, and now you have incredible security problems.

That's one way this happens.

There are many others. Reality is a lot more complicated than what you are trying to suggest.
The same properties that make phone numbers bad also make email addresses, postal addresses and other IDs bad. Sometimes a weak option is better than no option at all.
Right, thanks! My US geography is a little rusty.
That's what tab completion and aliases are for. The long command names are mainly there so that everything is consistent and there's not much guessing involved what a command does (or when you need to find something).
Ignoring the results here, isn't the act of disassembling random Android APKs illegal? Theoretically, could one of the affected companies sue them?

Also, if services only give you a single secret key per developer, what is the alternative? Proxying all API requests through your servers might work, but only with low-volume and if the service doesn't have rate limits per IP.

Most other schemes would require cooperation from the API providers, right?
Perhaps, as with the US you retain the honorific title 'President' even after leaving office.
Google does let you have 2 factor setup without a phone number as a factor, but strangely you need a phone number temporarily. You add the phone number as a factor, then add other factors (such as Google Authenticator and Yubikeys) then delete the phone number.
A woman dies of a superbug resistant to every available antibiotic in the US
Somebody can abuse the backend as a service as well, so proxying access to something like Twitter doesn't help that much.
Can't believe how much ; DROP TABLE "NAME"; has grown!
Many apps do not require account registration, so then what? I guess it could generate a server-side API token on first login then persist it. But then you need an API, which adds unnecessary cost.
Good Math: A Geek's Guide to the Beauty of Numbers, Logic, and Computation

https://www.amazon.com/Good-Math-Computation-Pragmatic-Progr...

A great review of college math and CS. The book goes over FOPL, Set theory, Turing machines and lambda calculus among other things. A fun read!
Are those Google ads Search or Display?
Then you could just sniff the traffic, or if you can't MITM the connection because of pinning etc. then you could still run the app inside a debugger and get the keys that way.

Note that if the keys are valid for all users, you'd only need to do this once per service.
The t-shirt folding thing is great.

Anyone know something similar for any other type of clothes?
Never mind why people need a password; why does McDonald's even need to have a website of any kind in the first place?
I am not implying any such thing.

What I am implying is that, unfortunately (again), government is the one entity that the common person is given a say in. They aren't a member on any boards, they don't manage philanthropists' thoughts or funds and they own no capital from which to generate their own wealth.

What I am implying is that they can influence the government into addressing their needs, even if superficially.
I for one will NOT use an Android app if there's no premium, ad free version of one.

I'll readily buy the ad-free version if it's any good, and I have the track record to prove it.

I've completely given up trying to control the torrent of spammy apps (games) on my son's IPad. His next device will be an Android.
Oh, never mind NULL.
What about hosting images on S3? How would one authorize access based on user? Use Cognito to map AWS IAM role to s3 resources at a per-user basis?
US has two presidents right now ;-)
What a good soul you are. Thanks for letting us now how much you care, and what you think a professional programmer is (someone who uses gender neutral language).

But not everybody follows your provincial customs or is a native speaker of your language.
I just wish that the distribution system of choice didn't involve me having to put all my eggs in some corporate controlled basket. I can live with losing a game or two because of me mistreating the storage media etc. But right now i risk losing access to all purchased games because of error on some server somewhere.
The URL at least is really dodgy, looks like a phishing scam. At a quick glance the gov1 can be mistaken for gov/ and lead people to think it's the official White House website. I'd think twice before clicking through.
Fair enough. My comment was mostly valid for the Wii and Wii U lineup, I agree that it's better for the DS.
Why would you do this when moving in particular?
Can Finance Departments Rely on Their Data?
E-mail is far from being perfect (you can get you account unilaterally closed by your provider or you can lose your domain name), but in practice I've been using the same address for more than a decade, and I have aliases that are meant to last forever (my almuni address), while in the same period I've had 5 different mobile numbers that I used for services like banking or IM, which is very inconvenient indeed.
correctiv.org is independent non-profit, based in Berlin, which is interesting setting. This is a rather small company, with editorial office in Essen. It looks like it relies on 16 journalists (some of them high-calibre), and one traineeto fulfil their duties. Of which Facebook is not the only one. Which inevitably poses a question, how good is this backup and is this not another kind of attempt of a Dutch boy stopping flood of the whole Nederland with his finger in the dam?

The dam is of course the German FB, standing the flood of fake news. I failed to recognise how many 'viral' stories on FB are fake, however, so can't really estimate that Correctiv is much of a finger in such a dam.
From what I remember (can't test right now), a zero-width space is okay as long as there are other (printable) characters in there too. This seems reasonable, because allowing a tweet to be a single zero-width space would make it appear be empty and probably lead to some confusing display issues.

I'm pretty sure I've used it to "end" a hashtag early, like in this made-up example:

I've eaten two #banana<ZWS>s today!

In my language, the possessive form doesn't take an apostrophe ("Alices Adventures" instead of "Alice's"), so for hashtags and user names it can be desirable to use the ZWS as an invisible apostrophe.
Not the parent, but I use Nextcloud for this (previously ownCloud). There are carddav and caldav sync applications for Android. I assume other operating systems have them too.

https://nextcloud.com
The point with email is that i CAN control the address myself. Sure i use external services to send and receive, but if that fails for some reason i can still setup my own servers and still have access to my accounts. No way of doing that with phone numbers.

Postal addresses are Name + Address so get invalidated automatically when i move. Therefore i would argue are also better.
The lost letters of the English alphabet
I find it weird how he calls himself the inventor. This knot is decades old if not centuries.
I make no claims about what is ideal only what is likely to survive.
I hope Donald will stay at home. Every presidential visit brings multi-million city to a halt. It has similar effect as an earthquake, major fire or other natural disaster.

It is recommended not open windows, there is risk of snipers. International airport is closed for several hours for a single airplane. And main roads are closed everyday while president is traveling.

I still remember New Orleans. People could not leave flooded city, because Bush decided to do a personal rescue mission :-(
> Lesson: Don’t run out of money.

Oh, of course, how come I didn't think of that?

I'm actually more interested in this footnote:

> I even sold “get on HN frontpage” as a service to local startups. I charged a whopping $100 per essay

Is good to have independent confirmation that people have moved from gaming Reddit to gaming Hacker News.
It's not infrequent to see occasional tension between vendors around the wording and timing of security disclosures. There are frequent examples of this with Google's Project Zero for example.

As far as disagreements on the best way to handle a security disclosure, this one is pretty straightforward and was entirely avoidable. The vulnerability in question is a runC vulnerability, it affects equally all products with a dependency on runC (not just Docker). The vulnerability had already been patched in runC, and an update to Docker had already been released and announced. So it was not a zero day. A few vendors (not just Red Hat) have incorrectly announced to their users that they didn't need to upgrade to the latest version of Docker because their enterprise-grade commercial platform would "stop the vulnerability cold". In the case of Red Hat, the commercial differentiator is what they call "security-enhanced Linux" using SELinux.

These vendors are under a lot of pressure to justify the high cost of their enterprise subscription by demonstrating concrete value. A great way to do that is to describe a scary vulnerability in a well-known product like Docker, and show that buying their product is the best protection against it. That is why the article talks about a "Docker vulnerability" instead of a "runC vulnerability" - Docker is a better-known product so the story will be more impactful that way. And it's also why the vulnerability is qualified as a "zero-day" even though it wasn't: it makes the vulnerability scarier.

Red Hat was privately contacted to inform them of their mistake. They privately acknowledged the mistake. When the article hit the Hacker News front page, they were again privately informed of that as well. In spite of multiple requests, after several days they have still not corrected the article. This puts the security of Red Hat users at risk by continuing to tell them that an upgrade to Docker 1.12.6 is not necessary. This is especially disappointing because of the obvious conflict of interest. It was a perfect opportunity for Red Hat to set the bar high for themselves and remove any doubts that they might put the security of their users before commercial interest.

The saddest part is that RHEL and SELinux have genuine security benefits that could be explained in very compelling ways without these shady marketing tactics.
separatist BS

So millions of people who feel strongly about things you don't agree with is bullshit? You might have been too harsh, but you are not helping your case.

The city's aiming high. Some people there have a dream. And all you can do is bash them and denigrate them and tell us how their (in some cases actually very reasonable) political opinions will bring their demise. Should they just not even try? I don't understand your logic.

BTW, it was obviously a PR piece. At least we agree on that :)
This is new to me thank you. I am a little afraid of locking myself out so i am hesitate to just try it, i will read into it and give it a try. Seriously thanks.
Forget Self-Driving Cars, Your Car Could Automatically Rat You Out to Police
Does this mean little bobby tables[0] might have trouble making online purchases?

[0]https://www.xkcd.com/327/
Just from reading the first few pages of the book, I'm already a fan.

However my one tiny complaint is that the sign-up box is on every page, and even after I've signed up, it still has to be closed every page I go to.
I'm very lucky to have started learning programming before these companies were figuring out their business models. I took the very first Udacity courses when they were completely free and was able to launch my career as a software engineer with the knowledge I gained from them. I was making barely enough money to survive at the time and had no idea if I actually wanted to make a career out of programming. If I had been forced to commit such a large amount of money at the time, I highly doubt I would have continued forward with the classes, and worse, they would have started to feel like work instead of fun, which was the issue I had with traditional college in the first place.

I sincerely hope that there continues to be sources of high quality course materials available without the risk and stress of payment attached so that other kids can have the opportunities I had when I was getting started.
State of Ad Tech: 2016, Year in Review
Interesting. I thought it rang a bell, and I indeed ran across a version of this a few years ago, via this paper: http://queue.acm.org/detail.cfm?id=2330089

However at the time it was Scheme-based. You wrote Scheme in one codebase, which was then compiled appropriately to (client- and server-side) JS plus HTML. At some point in the past 5 years it must've been overhauled to use JS as the unifying language instead of Scheme? I can't find a history page on the site or any information about that change, but I'd be curious to read about it.
Exactly! And you dont simply loose a domain if you dont really fail at renewing it, which usually is a peroid of 2 months getting reminder emails.
Modern XMPP Server (Prosody HOWTO)