skysight-inc/HackerNews huggingface dataset:
You're absolutely right that from a dietary perspective, and painting with a very broad brush, Chinese people in general eat healthier than Americans. My spouse certainly eats healthier than I do, though I've been a bit of a bad influence.

My point was about food safety, not nutrition. To some extent I can control how healthily my children eat by choosing what to feed them. But while in the US we can be fairly confident that the food and drugs they get are safe, that is less true in China, due in part to some recent food safety scandals like [0]. When we travel to China, there are certain things (like infant formula) that we bring with us rather than buy there. We also bring things like vitamins to my in-laws because they ask us to.

[0] https://en.wikipedia.org/wiki/2008_Chinese_milk_scandal
Isn't there an on-premise labor economist on the payroll? I mean, a bachelor level econ student could have told them this. Interesting still, is that there is real-world proof of an upper limit to pay in this industry given the a typical labor-leisure curve
Not true, executives don't create shit. If they leave without any prospect of making money, they can't create on their own to earn. Developers are creator, given enough money, most would leave to take a chance at bringing their own creation into the world. This creation could possibly make money. Sometimes it's not even the money, it's the idea of having your project seeing the light of day. Working on a project that might not see the light of day or that might ship in 10yrs can be very frustrating for creators.
Note that this argument is even more problematic for OpenPGP-encrypted email, as such email sends all metadata and some message data in plaintext.

I ususally respect tptacek a lot but when it comes to Whatsapp I actively avoid it if at all possible, preferring Telegram even if the crypto is more than questionable. Same goes for mail: I prefer it - even unencrypted - over Whatsapp.

For some of us our treat model is more concerned about Facebook and less about major TLAs.

With Whatsapp I have to expect that all metadata about me - and my friends - are fed into Facebook and datamined from here to eternity and back again or until the end of the world as we know it.

I have little to hide but given the catastrophically bad ad targeting of Facebook (yes, I am still a happily married father, a Java developer, a Norwegian. I don't need ANY more ads for dating websites until I specifically change my profile to let you know, THANK YOU. I would be happy to learn about useful developer tools or underrated fast food restaurants though. I also appreciated the uber ad with bundled coupon in google maps a few weeks ago and tested uber for the first time.)

Given the same catastrophically bad targeting and given that it is the same owner who as far as I know hasn't yet apologised for his remarks about how trusting him was stupid it wouldn't surprise me if is more a WHEN than a IF that Facebook is going to sell everyones data to insurance companies, support scam call centers etc.
>And if the hardware itself has microcode that overrides your code?

Hard to defend against this, but it can be helped by using well understood architectures and letting us confirm that the microcode being run is the same microcode that the upstream CPU vendors are publishing.

>Actually, I think the first and foremest threat would be, "Could someone insert a yubikey into a malicious device that changed its behavior such that it now leaks information and does not provide actual security."

I'm not going to keep entertaining this discussion if you keep disregarding everything I've already said. I've already said I'm only asking for read-only access. In any case, defending against physical compromise is close to impossible anyway.
*edit: anecdote ahead

My experience working as a clean air and water advocate in my
early 20s was that people who don't buy into climate change also tend to rationalize away things like potable water, wildlife, and preservation of natural resources. The venn diagram of people who don't "believe in" climate change and would support CO2 cuts to stop ocean acidification is tiny.

However, I'd love to be proven wrong.
As a pretty bad home mechanic, I want to agree with you. The DEF in my BMW went bad (urea has a short life span) and BMW charged me out the wazoo to reset the computer auto-shutdown feature (you get 200 miles to fix it or it won't start again) and I had no other choice, since I can't do it myself. I can flush the DEF, but I can't reset the computer without their tools. I don't believe even iCarly can un-flag the error.

On the other hand, my political beliefs tend to say that government exists to protect you from me and me from you, and the emissions of your vehicles falls into that category. So maybe there's an argument to be made that at least certain parts should be locked down?

(for the record, I don't think any of it should be for the sake of competition and home repair, I'm asking for the sake of conversation / devil's advocate)
The Euro has been a gold standard hung around the necks of the poorer Eurozone countries. They haven't been able to devalue, engage in Keynesian stimulus, or do anything else a country normally ought to do when confronted with a demand-driven depression, let alone a financial crisis.
Suggestion : consider disabling comments on the blog.

I noticed that on most technical blogs, the discussions in the comments are either non-existent or an "Awesome post" type response. The real discussion happens on sites like HN, reddit.

There is no real downside to disabling comments altogether on technical blogs. Just leave a PS asking for comments to be sent over email.

The upside to disabling comments : way faster load times and less data transfer per request. Disqus makes like 30 odd requests to load their comments.

Disqus also does some creepy things : when my blog experienced a spike in traffic, Disqus suddenly decides to run ads on my blog without explicit permission.

Regarding Facebook comments : :|
It appears very WordPress centric because this was posted on a website targeting WordPress hosting for business. But they'll affect anyone using the Disqus widget in their sites.
I would quit after even less money. I would dabble with tech but no way I would ever go into an office again. Some people like CEO's genuinely seem to enjoy business but I personally don't.
it worked for everything i was using it with. but same problem as the OP mentioned, i dont always have my keys on me so it just became annoying after a while having to the thing first
That doesn't mean they aren't real. Did you see that article on cursive writing? (https://news.ycombinator.com/item?id=12193539)
> * Email remains important for middle-class Americans because it's used for business. But that is a small subset of the whole population, including very large numbers of Americans.

Middle class Westerners (not only Americans by any mean) that are doing business are also pretty much the only ones that are willing to spend money on written communication. E-mail might not be on the rise, but I'd guess it grosses way more money than all IM platforms together.
Everyone is different, and I realize that the actual number doesn't matter, but most people able to make 5MM in bonus on wall st wouldn't consider that amount anywhere near "F-you money".
Why use PGP anymore when you can use Keybase and the next generation of key management?

Instead of having one master key for your identity, the paradigm is changed:

Identity is a set of claims "X on domain A is Y on domain B". That's it.

"Domain" can refer to a server-based service such as reddit, or a client app on a device.

Such proofs are easy:

1) For public identity on sites which don't support this scheme, X simply signs something with their private key for A, and posts it on A at a URL only they control (such as an About page or a Facebook post). Presumably, X and A had to cooperate to do that. Now, to prove "you are X on A", you simply claim your your identity and the url to check, and sign it with the same private key. The verification proceeds by checking the https url for the actual claim. You hold that key. If A wants to revoke your identity proof, they just delete it from eg your profile. Each site A has to be supported individually by the client lib though, because "urls you control" are different on each site.

2) For private identity on sites that cooperate, there is a huge variety of things you could do. Everything from oAuth 2, to the signature scheme above, except the user id X on A can be different for each relying party B.

So the claim "X[B] on A is Y on B" is a private claim - others can verify it only if they identify themselves as B (eg X must be logged into A and using https on A and B and doing cross-domain communication using iframes).

They can't satisfy these conditions unless they spoof B's SSL certificate and trick X into visiting their site via a poisoned DNS. And in that case they can just find out that X is X[B] on A. Very limited privacy leak. They still can't decrypt or sign anything as X on A.

This is the scheme anyone can implement and use. It should be standardized IMHO somewhere.
> XMPP tried to address this and failed

XMPP aint't dead yet ;)
you have to live in the US for the duration of your YC batch.
As someone with no Rust experience...

a) access to invalid memory regions, b) dangling pointers and attempts to free already freed memory, c) memory leaks
and, d) race conditions.

The first three benefits also come with essentially any GC'ed language. d) is interesting. What are the costs that come with such a guarantee? Presumably it prohibits certain kinds of parallelism? Are the ownership/borrowing mechanics interesting programming tools, or are they a hindrance?

People talk a lot about static typing, and I can see the benefits for critical/user-facing applications, but not for numerical code. The nightmare with numerical code is finding out that I forgot a minus sign somewhere, and that it invalidates my last 6 months of published results.
I sometimes preferred it even on Windows and even when I have a valid office subscription.

Some people really manage to mess up styles and Open or LibreOffice used to make it much easier to clean up those docs. (I'd switch back to get page numbers right though :-/)
Professor Leonard is really great if you need some extra help learning something. He moves slowly enough with the material that it's difficult to get left behind, however that might be too slow for most HNers.
It does, for individual operations: https://doc.rust-lang.org/std/?search=fast
5 million dollars will look great only until you have them. Once you get your 5, your next target may be 25, then 125.. x=5*x. Engineers who work to create amazing things, work to get a kick out of creating cool stuff.Same case with CEOs. money feels great, but never enough..
> yet somehow surveillance/privacy laws don't have to be renewed for years on end?

Actually they typically do (e.g. USA Patriot act). Sadly it's usually a rubber stamp with a bit of ritualistic, minor opposition attached.
Hey! Joshua here, co-founder of TalkJS. Thanks for your feedback, you're right! Will fix asap.
It cut your cloud services bill by 93%, but how much did it increase your engineering bill by?

If your engineering time is free, then this calculation is complete. Otherwise it is not.

Does that 93% saving pay for a DB engineer, or enough of your developers' time to build the same quality of redundancy as you'd get with a DBaaS?

This calculus is going to be different for every DB and every company, but the OpEx impact of switching to dedicated servers is a bit more complex than you suggest above.
This is fine, but make sure the take-home test is truly respectful of candidate time. It shouldn't take more than 2 hours max for the minimally-acceptable candidate. The best candidates have a lot of options and therefore see little reason to commit a large quantity of their personal time to any particular candidate-employer.

Some people are doing the take home test but they make it into a multi-week ordeal, or say it should take "about a full work day", which always stretches out into 4-5 evenings after the real-world is accounted for. I've never had enough interest in working somewhere to finish those long take-home tests; always get like half to three-quarters of the way done before I decide I don't really want to work there that much anyway.
No problem with the language itself more of a problem with the people who use it and their compulsion to use it for things that don't need it.

For example it feels like we can't go a year without WordPress making the news for a security flaw.
Really, because $5M seems like an enormous fortune to me. It's an amount you could stick in a savings account yielding only 1% interest and pretty much live the rest of your life with a decent lifestyle somewhere with a low cost of living. OR, you could quit your high-stress job and augment that interest with a more fulfilling career.

I can pretty safely say a single $5M bonus would amount to an instant lifestyle change (namely less pressure to work) for me.
I have accidentally discovered a bug in Clang that causes the compiler generate millions of consecutive "addq $2147483647, %rsp" instructions and it wouldn't terminate maybe in hours (it could probably be an infinite loop, I haven't seen it terminate):

$ clang --version
Apple LLVM version 8.0.0 (clang-800.0.38)
Target: x86_64-apple-darwin16.4.0
...
$ cat test.c
#include <stdint.h>

int main(void) {
int x[SIZE_MAX / 31];
return 0;
}
$ clang test.c
test.c:5:11: error: array is too large (595056260442243600 elements)
int x[SIZE_MAX / 31];
$ cat test-2.c
#include <stdint.h>

int main(void) {
int x[SIZE_MAX / 32];
return 0;
}
$ clang test-2.c
... Keep waiting :-) ...
The submarine piece was a submarine piece to try to get people to generally ignore the press for anything substantive and instead elect Trump as president.
I agree with not using WhatsApp due to it's ties to FB and metadata issues, but Telegram is arguably even worse. They've been (rightfully) panned for implementing their own crypto and doing it poorly. You should be using Signal on a phone if you're trying to use a secure messenger.
What could musk possibly be building for this neural lace? I just can't think of any modern technology that's up to the task.

Any ideas?
I don't have those numbers. I know there have been some publications lately that suggest there is an increase, which make sense since I doubt the number would decrease, but like browser usage stats, those numbers are heavily dependent on the audience they were collected from.

My non-technical friends have never mentioned ads to me before in the context of the web. I doubt that means they appreciate ads on sites but I don't think it occurs to them that they need to find a way to remove them. I think they appreciate that Hulu lets you pay to remove them, or that Netflix doesn't have ads, but I never hear "this website sucks because of ads." They just assume it's the way of things.
If You’re Too Busy for These 5 Things: Your Life Is Off-Course
That pricing seems insane :o. Even on the lite setup, each conversation would need to have $2 in value, on the standard plan it would need $2.50 in value (I know there is an increase in features but an increase in price per conversation as well?). Although I am not quite sure what a conversation consists of -- it could be a chat between two people over any timespan, in which case it really isn't terrible?
That's a rather different point though. In the case of Yankee Doodle, the Americans new what it meant and used it as an act of defiance, where the other poster was talking about people missing the point entirely
Manoush Zomorodi Challenges Us to Stick Up for Our Internet Rights
Sure. S-expressions[1] are a notation for nested data structures. They can be used to spell out data as well as code. In fact both code and data look the same when expressed using s-expressions.[2]

When the article's author describes both code and data using JSON, it sounds a little strange to me. While JSON is capable to describing nested data structures, JSON's syntax is much more verbose than s-expressions. I feel that since s-expressions have been around for about 60 years that the author should be familiar with them and address why a JSON encoding is superior to s-expressions for this use case.

1 - https://en.wikipedia.org/wiki/S-expression

2 - http://wiki.c2.com/?DataAndCodeAreTheSameThing
Diet Culture Exists to Fight Off the Fear of Death
>Krishnamurti's teachings are based on scriptures such as Upanishads and Gita.

I am curious why you say this?
From the article: "The good news for the paranoid is that TfL appears to have gone out of its way to make sure everything is above board. In the documents that Giz UK has seen, it makes clear that it is only MAC data that’s collected (ie: they’re not monitoring the websites you visit) - and that this data is stored as encrypted hashes - so even if hackers could somehow break in and obtain the collected data, they wouldn’t be able to get any MAC address data."

"Encrypted hashes" isn't totally specific given the vague language used when talking to general audiences, but assuming it means a cryptographic hash, then that doesn't really give much (any) privacy. There are only so many possible MAC addresses, and it's pretty easy to try them all in minutes. I was going to do the math, but Threatpost already has an article about this.[1] There's also a stub Wikipedia article.[2]

Unique salts don't work if you still want to be able to compare MAC addresses, which is sort of the point. You can have a single salt for all hashes, or alternatively encrypt with a single key, but then it's just a matter of that single salt or key being leaked.

+1 for randomized MAC addresses.

[1] https://threatpost.com/research-finds-mac-address-hashing-no...

[2] https://en.wikipedia.org/wiki/MAC_Address_Anonymization
You could also consider Google as Alphabet's primary, or "alpha" bet, but Google is also investing in a variety of "other bets". The name also provides for cool URLs, like https://abc.xyz.
A client's admin sends credentials via email - including logins and passwords for mission critical infrastructure. When asking him about security concerns he said: "Our mail server's using HTTPS, everything is secure"

I haven't responded to that.
Do you have a source for this? Your statement doesn't carry any weight if you can't back it up. Anecdotally, I have seen a rise in non-tech-savvy people using ad blockers, but I'd be interested to see some hard data.
I thought it was because Umbrella corp was taken
It is significant:

https://pagefair.com/blog/2017/adblockreport/
Well, the previous Cuban government gave the US permission for the base at Guantanamo Bay. Then the Cuban Revolution happened. The US does not have permission from the current Cuban government, but is holding it to the agreements made by its predecessor.
If I pay you $5M and your job is "work at this hellish call center" then yeah, you probably will take it as a lottery ticket and get out. If we make the CEO miserable (every day you must call each board member individually and explain why the company's stock has not gone up yet), I bet they quit too.

The important factor here isn't the money.
I get what you're saying, but the definition of the term 'prominence' doesn't help you, because by definition, Mount Everest's 'prominence' equals its actual height above MSL. This special case is necessary to give the recursive definition of 'prominence' a base case.

However, it's true that Mount Everest's "relief above local terrain" is not equal to its actual altitude above MSL, but this is just informal empirical footballing and no rigorous technical definitions exist.
Simple Static Malware Analyzer
Sounds awesome. Before starting a family this would have been my dream job. Ski & code 7 days a week. Kudos to whoever lands this gig.
From what I've seen, most of the Rust community agrees that using stable a perfectly fine choice; kibwen is offering context, not complaining.
> if you keep disregarding everything I've already said. I've already said I'm only asking for read-only access.

And I've addressed that.

> In any case, defending against physical compromise is close to impossible anyway.

This is a non-statement. I think your religion is getting in the way of further discussion. Goodbye.
Why Ariel Elkin Isn't a React Native Developer
> How do you clone a YubiKey?

It's a one-time write of a seed at device set-up time. It's not an exact clone, but will give the same response to certain challenges.

https://www.yubico.com/support/knowledge-base/categories/art...

https://www.yubico.com/products/services-software/personaliz...

> I thought the whole point of having a hardware token in the first place was that it's _not_ easily copied?

The process generally requires the person personalizing the key to intend to make two (or more) from the beginning of the process. Otherwise, the secret bits that must be entered into the other device to allow one's 2nd Yubikey to generate the same responses to the same challenges will be lost...
Lisps aren't limited to lists as data types, you can have anything you want.

Lisp interpreters tend to be dead simple to implement.
No, you're exactly wrong. The demand on Rawls is that he do whatever work is necessary to produce the drives in an unencrypted state. If he hid a printout of the password on Mount Everest, that means he is compelled by the court to climb Mount Everest.
And the argument may have appealed, 130 years ago. Since then we've quintupled our population and gained a much better understanding of carrying capacity. That capacity may be larger or smaller than our current population, but in either case, indefinite growth is not a sustainable plan — unless we know where our next planet is.
Mostly reasonable criticism.

My question, though, is whether JavaScript's dynamic typing is that much of a problem for someone who's used to statically-typed languages.

So is it?
Is diet soda really any better with regard to health? I was under the impression that the sweet taste without the calories causes problems with insulin or satiety or something (can't recall details).
Yara – Pattern matching swiss knife for malware researchers
Something I've been wondering. Does the earth's core have negative heat capacity?[1]

I've read that it is usually modeled as a self-gravitating system[2], and that such systems can end up in states with negative heat capacity [3].

[1] > "If the system loses energy, for example by radiating energy away into space, the average kinetic energy actually increases." https://en.wikipedia.org/wiki/Heat_capacity#Negative_heat_ca...

[2] > "The Earth’s outer core is a rotating ellipsoidal shell of compressible, stratified and self-gravitating fluid." https://www.uleth.ca/dspace/handle/10133/3672

[3] > "Negative heat capacities can only occur in isolated or nearly isolated systems. They are
impossible in truly extensive systems in canonical ensembles or for that matter in grand
canonical ensembles. However, far from being a strange phenomenon only found in the
thermodynamics of black holes they occur widely on a macroscopic scale in astrophysics and
with less precision on a microscopic scale throughout physics and chemistry. They are the
origin of the large fluctuations that occur at phase transitions and we speculate that they
cause those transitions." http://adsabs.harvard.edu/full/1977MNRAS.181..405L

Edit:
Also, the link to the paper leads to a 404 page...
Stabilization of body-centred cubic iron under inner core conditions, Nature Geosciences, nature.com/articles/doi:10.1038/ngeo2892
Football, fire and ice: the inside story of Iceland’s remarkable rise (2016)
It's definitely a drop in the bucket.. The combined revenue for PepsiCo and CocaCola is over $100 billion per year.

$10 million/year fighting against soda taxes represents 0.01% of their revenue. I'd be surprised if they were only spending $10m/year.