skysight-inc/HackerNews huggingface dataset:
Honestly, it's like the Trump administration is trying to undo any social and economic progress since the 80s.

When did the US become so complacent to shit policy? We've tried war on drugs before, IT DOES NOT WORK. We created 'bad hombres' down there.

The crack epidemic was another racially and politically motivated solution.

The fact we still use a law, to this day, that was created to cause destruction to hippie/black communities and break down protests against the war is absurd.

And anyone, in 2017, that still considers drug use a law enforcement issue is out of touch with reality and science.

So fuck the Republican party right now.
But there should be ways to accelerate the process of moving in the right direction.

That's true on highways as well, but it's not safe there. What makes it safe here?
They don't really have to follow the rules. They just have to drag their feet long enough for your project to die.
WHAT?! NO! TRUMPIST LIES, ALL OF IT!

Everyone knows that gerrymandering is the only way Republicans ever get any votes — really they should get zero!
I thought you were kidding. I apologize for that. What a tedious piece of smug self-puffery.
Porn-o-nomics: Who is watching you watch porn?
No, one of the characteristics of a cryptographic hash function is that output should be completely unpredictable based on input. So the probability that the low order bits will change vs the high order bits should be exactly the same given any arbitrary inputs.
Sandbaggers. Such a perfect description.
The obsession with Sweden
>I think SHA-512 is resistant to near-collisions

All good hash functions have an even distribution, and are therefore resistant to near-collisions. Hash tables for example require this property to work properly.
> Nice, and you've really polished that onboarding experience.

Thanks ! Alas, Tanmai (our CTO) will quote this at us for the foreseeable future, this being his idea.

> So, what's the registration code?

This is just something that is used with the startups and incubators we partner with. You can ignore this.
Six Simple Ways to Boost Your Ecommerce Conversion in 2017
Layer modeling techniques shared by FoundationDB (and still available in the internet archive) are still immensely helpful even without the database.

We are happily using them to implement and optimize our local storage on top of LMDB (another awesome database). However, these approaches could be applied to any other key-value database with transactions and lexicographically stored keys.
From both the blog post and the website, it's not clear to me what this buys me over plain Docker (or possibly Docker + Compose). Is this a Compose competitor?
Why is the author referring to the most hidden layer in a vanilla autoencoder as the latent space? I thought only variational autoencoder uses the latent space for generative purposes.
Can't speak for Spyder, but one killer feature of RStudio is the ability to easily make C++ modules that your R project uses (RCpp rocks - you can ignore most of the annoying things about C++). They compile and link with zero effort. Also the ability to easily install modules. And browse documentation. And create projects in R or RMarkdown. Create modules, basic scripts, web apps. And publish things. And see your data in a spreadsheet format. And inspect all your objects/data/functions. All in one place.

Aside from RStudio, I love R's lispy/apl-ish semantics, and easy integration with Fortran/C++ (and a host of other languages, including Java, Haskell, Ruby, Prolog, Lisp, etc...).

I'm sure Python is great, but R is made for stats, is amazing, and RStudio beats every IDE I've ever used, regardless of language.
One of the things i like about ycombinator is the active and consistent moderation policy.
In the early 1990s there was a very conceptually similar game called the Internet Hunt:

https://en.wikipedia.org/wiki/The_Internet_Hunt

An example of the very first one, from August 1992:

http://www.ibiblio.org/history/1sthunt.txt

Google has definitely made these a lot easier, so the questions have had to get a lot harder!
Only a few hundred sites were leaking, sure, but the leaked info could have come from any domain that was being proxied by the same edge server. So we would do better to assume that any domain that uses Cloudflare could have had their passwords and other sensitive info exposed via leaky neighbors.
Have an upvote, that makes sense.
CDNs still provide a better experience by having faster open connections to the origin, local TLS termination, security/DDOS/WAF protections, and more.
For you ssh sessions, have you tried to use ssh keepalive ? (ex: ServerAliveInterval option on an openssh client)
Fun, I did the same thing as a clojure repl exploration to pipe PDF text to a bare Swing GUI (I know, a little absurd in a way).

The deja vu made squint for a minute.

ps: pdfbox is nice
How Used Cars Became a Security Nightmare
Hi,

I think you have misunderstood the issue. Just because YOU did not use those services does not mean your data was not leaked. It means that other peoples data was not leaked on YOUR site, but YOUR data could be leaked on other sites that were using these services.
T-shirts. He only got one.
Try Incapsula?

Never used them. Had a quote sitting on the table at one point.
Uber's Leather Boys
Where there are problems this massive, there is opportunity; reforestation, biodiversity, businesses that utilize existing ecosystems without devastating them. Forty years ago environmental protection was seen as being at odds with economic progress. This perception is changing because it must. Tesla/Solar City I hope are only the beginning of aligning great technical achievement, economic viability, and environmental sustainability.
The Royal Commission into Aboriginal Deaths in Custody (1991)
The sha-1 attack is only a collision attack. It's not a pre-image attack. So if you clone a git repo and want to sneakily replace an existing object, you will not be able to do this because one of the inputs has already been fixed.

In order to perform that kind of attack, there would need to be a second pre-image attack, which does not exist right now.

Even md5 still has second pre-image resistance with a search space only slightly below the entire output space.[1]

1. http://crypto.stackexchange.com/questions/13303/is-md5-secon...
Ask HN: How do IT departments handle diverse operating systems
We are still using Win7 (and latest MacOS) as the default OS at my workplace. There are roughly 2000 developers in the company and probably around 90% of development is done on Win7.

In your experience, how can different Windows versions be managed in such environment? The IT department installs various default packages (VPN, chrome, antivirus, etc...), but not much else and nothing particularly special. All our internal sites (at least the ones that are usually accessed by the developers) work with Chrome.

I'm asking because i'm trying to come up with arguments to convince the IT people to allow developers to choose their own OS/hardware.

thanks!
That's not really true; execution is a factor but playing mind games with your opponent and deep knowledge of what they can do is important to high-level play. Saying Street Fighter is about muscle memory is like saying being a quarterback is about throwing a ball. But sub out Tetris or something if it makes you feel better about the analogy.
I simply have no idea how you would find out the pervasiveness of the technique, but i remember learning how to acquire an amazing amount of detail about a user who visits your site. Version of client, resolution of screen, plugins, configuration settings, input methods, and last but not least, IP, etc etc. When you realise how many things there are, and how many different variations there are, you can pretty effectively verify a user is a particular identity, even if you don't know their name.

It's not even that hard to record it. Analyzing the data is not really that complex a problem either.
Fwiw, I'm a Navy physician and have the same problem. Wait until you know, that right now, someone is very sick, and the study you're trying to look up is hosted on a server in some super sketchy non-ally, like Switzerland.
She also commented on Twitter today that someone was contacting all her acquiantances looking for dirt on her. Uber is denying it's them but they've done similar stuff when they've gotten into trouble in the past.

Great transformative product but they've certainly failed on building a healthy culture.
The composition of the result of the original hash function and the result of that validation function can be taken together to be some larger function. Call that an uberhash. Such an uberhash is created by putting some number of bits in and getting some smaller number of bits out. There will unfortunately still be collisions. That trick is an improvement, and newer hashing algorithms contain similarly useful improvements to make creating collisions difficult.
Thanks for clarifying. You are absolutely right.
In the UK I can see a similar pattern to what has gone on in the U.S. so I am willing to agree with the author.

With anything psychology it can take many years to spot what is truly going on and to have the words to understand that. By nature we are deferential to our parents and live life by their values.

The classic for me is the boomer advice to their children to save like they did to buy a house like they did. The boomer houses get chopped up into flats costing £500000 each, so a boomer house is probably a good £1.5M and that is a lot more than the inflation adjusted amount that they paid. Easily ten times the amount. That is a lot of cash to get out of the younger generation for them to buy boomer property.

With the advice to save and buy a house there is no appreciation that the situation has changed, any protests will be met with how the younger generation have to just work hard like they did. They can't be told that their generation stole the wealth.

There was extremely high inflation in the 1970's when the property-as-investment craze got going. Property was always kept out of the inflation index even though rent/mortgage is the biggest expense anyone pays. House price inflation has been double digit and always praised as a good thing, which it is for the boomers. There are years when the property market crashes but boomers can ride those situations out, they can still borrow against property.
Just posted a few minutes ago: https://news.ycombinator.com/item?id=13730271
> i really marvel at the mental gymnastics/machinery that goes into convincing oneself that humans are somehow a class apart from animals

One can even characterize the history of science as a timeline of refuting humanity's exceptionalism starting with Copernicus's technical and metaphorical discovery that we are not the center of the universe.

Lately, I've been wrestling with the issue and come to the conclusion that consciousness is either something that all life possesses or simply does not exist.
> Because many customers don't actually want a dumb pipe.

Yes, they do. That's exactly what they want. A dumb pipe that transports their bits and nothing more.

I'm omitting your list about dumb pipes, as nothing you write has anything to do with dumb pipes and is all completely wrong.

> Personally, I'd like a dumb pipe only as far as the nearest major datacenter, and then quite a lot of smarts in that datacenter. I don't just want a raw connection to a major bandwidth provider, though.

Hate to disappoint you, but there are no smarts in any ISP datacenter. It's just a big router and some interconnects. Raw bandwidth is all you get, if you are lucky.

> See also the last paragraph of my previous reply: I'd be in favor of separating out the "dumb pipe" as a utility, and then having ISPs operate independently from that. I think that would solve the majority of the problems.

It's not that simple, there are a lot of implementation details that matter. Do you want local loop unbundling, bitstream access or only resale?
We only host our static corporate sites (not apps)

If this part is true, they're not vulnerable. Only data that was sent to CloudFlare's nginx proxy could have leaked, so if they only proxy their static content, then that's the only content that would leak.

The rest of their comment gives the wrong impression though, yeah.
Major discussion from earlier today: https://news.ycombinator.com/item?id=13725529.

(We changed the baity title in accordance with the HN guidelines: https://news.ycombinator.com/newsguidelines.html)
Previously post and discussion https://news.ycombinator.com/item?id=13645213
Nyughh. Sad. This hits me right in the heart. I have been to the Amazon and it is lush, beautiful paradise. It changed my perspective on how valuable natural life is on our planet.

It is not just the net loss of plant matter. The indigenous are under constant duress and we risk losing a unique part of our world; medicinal plants and esoterica, wild-life, and access to limited resources, to boot.

There are groups working with those impacted by this. I am contributing to an NGO called the Alianza Arkana which is doing some work to aid the indigenous and the rainforest.

Contextual plug: http://alianzaarkana.org .

I left a grand paying, comfortable tech job to try to make even-a-small difference. I hope this devastation is not a part of my generation's legacy.
For reference, DigitalOcean's $5/mo droplets have 512MB memory [1]. This will crash if you're building a golang projects like gogs or C extensions in node or python. YMMV, but I had to bump on DO droplets to 1gB memory for installation, even if 512mB could do it while running.

Linode is top tier. Support is great. Interface makes sense. Instances are fast. One of the things that led me to DO was the $5/mo instances though. It's hard to resist a cheap personal server you can host all your legacy projects stuff on.

[1] https://www.digitalocean.com/pricing/#droplet
"(...) deforestation rose in 2015 for the first time in nearly a decade, to nearly two million acres from August 2015 to July 2016. That is a jump from about 1.5 million acres a year earlier and just over 1.2 million acres the year before that (...)"

...so really it did rise in 2014, from 1.2 to 1.5 so the first statement is false, isn't it?
We've banned this account for breaking the HN guidelines. Would you please stop creating accounts to do this with?

Everybody's political feelings are inflamed these days, so we all need to work together to prevent this site from going down in flames.
+1. You can't compile node on 512MB of memory. You need to allocate swap to do so.
I always think of Herzog's "Aguirre, the Wrath of God" :)

https://goo.gl/images/jcjzLz
Lateness is a mostly meaningless metric. On the one hand, it's vague, and on the other hand, it has little inherent value. Doubly meaningless.

For example, let's say a team is given 4 projects. They provide rough effort estimates and schedule those projects on the calendar, with normal buffer for support issues, changes, etc. Then a new ultra-high-priority, life-of-the-company-at-stake project comes down from the CEO, and everything else gets pushed back by months.

So, are those original 4 projects technically late? By many studies' definitions, they would be categorized late.

Furthermore, does it matter if they are late? If you're late on 80% of your projects but deliver on time for 100% of your critical projects, is that so bad?

Not having the demo ready for the tradeshow is a real problem. Not having the compliance changes in by the deadline is a real problem. Not having the integration upgrade done before your partner turns off the old version is a real problem. And so on. Missing some date that was arbitrarily chosen, probably months or years ago, eh, that doesn't necessarily bother me.

I'm not arguing that it's good to be late. It's obviously better for projects to be delivered when expected to let businesses make projections, plan, etc. I'm just saying the real world is messy and full of tradeoffs. If you're constantly reacting to fires and unexpectedly missing deadlines, that's a sign that better project management is needed. However, if you're working with business stakeholders to reprioritize efforts and adapt to changing realities, that can be good in my opinion – even though externally it can appear that projects are "late".

Edit: To be clear, I'm not really agreeing or disagreeing with parent's comment on the source of lateness. I'm commenting on using stats like these as evidence that something is broken in software development.
Lithuania Is Great Again for Doing Business
DJ Duvvada Jagannadham Teaser – Fans Reaction
My only complaint is that it often explodes when using vim or pagination certain files over SSH.

Also ctrl+w by default in cmder closes the tab instead of the bash equivalent, I always have to unbind it.
> For instance all pre-emptible instances are terminated in 24 hours. On AWS based on when they need the resources.

Uhh, Google will terminate preemptible instances whenever they need the resources as well. Hence the name, "preemptible."

https://cloud.google.com/compute/docs/instances/preemptible
So far as I know, nothing like this thing has ever happened at any CDN ever before.
Please don't post unsubstantive comments here, especially ideologically inflammatory ones.
As someone with 5-10 active Go projects in production, may I ask why you're compiling on the server? I use cross-compilation to build locally then sync to the server. Am curious to understand other use cases.
It really is crazy fast. I get notifications from my browser and phone about new emails almost simultaneously. And if I read the notification on my browser, it instantly disappears from my phone, and vice versa. Honestly, it works how it just ought to. Can't give higher praise than that.

I've been super happy with Fastmail. Can't recommend it enough. The stuff they're doing with JMAP is really nice too -- should give it a read if you haven't seen it before.
"Nature with a capital 'N' is my Religion" - Frank Lloyd Wright
So I guess we've finally reached Ferengi levels of consumerism?
https://www.youtube.com/watch?v=zUvARUC9k9Q
This is straight out of my homework for an introductory to CS class. If I can recall, we need an IF statement to detect whether the element IS INT, else length of list. Then just add [Int] or list[:] to the new list.

Ok point being: I didn't believe what I was learning was relevant to industry, in particular linked lists.
I have actually thought about getting a tutor for this reason. Do you think tutoring is a good solution for this particular goal?
do we know which other animals have chosen to be vegetarian ? Apparently squirrels are usually vegetarian but they'll eat meat if their survival depends on it
I've also been looking into the same question, and I don't see any external indication that they consider themselves a Business Associate as far as their policies go. I would argue, however, that CloudFlare is a BA by definition if an application is using any of the WAF or SSL proxy functionality.

We've been reaching out to a couple of vendors that do use the proxy functionality (given that the data spill could impact our clients as well). Hoping to resolve the BAA uncertainty in the process too.
I have been using KeePass for many years and didn’t know about this. Thx for the link
Would a typical load balancer/web server running NGINX doing SSL termination see an improvement switching to Skylake?
For what it's worth, in the general case, I think you're right. The only thing that makes this case different to me is that the one comment CF's CEO has decided to make on HN takes a potshot at Google, which is newsworthy --- but if we took every notable comment on HN and put it on the front page, that's all the front page would be.
Folks, can we please stop downvoting the parent of the linked comment? It's of no use when it disappears from HN.
Things are getting scary. I don't really know what to do. It feels like my country has gone completely mad. Empathy and reason feel forsaken. Some things incite protest, journalists point out what looks like insanity, and at first I'd agree and feel some vindication that perhaps all is not lost. Now each article, each sign held up, feels like just another example of powerlessness and inefficacy. Screaming into the void. We've become everything I was taught we shouldn't be and those fighting seem to be doing so in vain. I don't really understand what's happening or what can truly be done.
we can just nuke the caches for all the domains that turned on the problematic features (Scrape Shield, etc.)

No, IIUC it's MUCH worse than that : a single nginx process would serve many different domains, and you would only need one of them with the problematic features turned on to trigger the bug, and potentially leak data from all other domains served by that same process (whether those other domains had the feature enabled or not)

I'm not familiar enough with CF's infrastructure to make an educated guess about the way they shard domains across their nginx fleet (assuming this is what they do), but in order to be able to produce a list of all "tainted" domains that were being served together on the same nginx process, at any point in time since September 2016, well their nginx config generation process had better be perfectly deterministic (and any changes thoroughly logged over time). Also, the bigger the shards, the more neighboring domains are affected by a single "poisoned" one, and the more widespread the problem is.

My guess is that if they had had a way to reliably piece together that information, they would have released a list by now.
We've banned this account. It's not ok to use HN primarily for political and ideological battle.

We detached this comment from https://news.ycombinator.com/item?id=13720963 and marked it off-topic.
Removed the banner - thanks
Waymo Lawsuit Against Uber Has Weak Legs
Originally I wanted no custom styling so the developer could decide, but I think I'll add either + - or ^ >
Burns was good as both God and the Devil in "Oh, God! You Devil"
If someone lets you live a happy life then hunts you down and kills you to eat, is that OK with you ?
If it's ok for you to rule on the life of a pig, say, then why isn't it ok for another human to decide on your life ?

(I really don't agree with this position - just playing devil's advocate)
We detached this subthread from https://news.ycombinator.com/item?id=13720517 and marked it off-topic.
Yours is much cleaner code though; this was my first venture in javascript (and really programming) when I wrote it and am planning on refactoring it soon(tm). Great work with Kapok, the demo page is well done.
Actually with http2 you can multiplex requests for multiple domains within a single connection. As long as the DNS for the domains is the same IP, and you have a single certificate covering both domains.
1)- Sudoku Programming with C : http://www.apress.com/gp/book/9781484209967
2)- Programming Sudoku : http://www.apress.com/gp/book/9781590596623
I haven't read any of them though. They are on my list of "books to read in the future"
To be honest that kind of scares me. What will happen when VR is commonplace and we are continually using it to escape reality.

Not to say we don't do that already, but the gradual degradation of reality is truly quite interesting.
So add a new object to the git repo (open source projects usually allow contributions) for which you already have a malicious SHA1-colliding object in your pocket. If your change is widely distributed, you now have a hash in the wild that matches your malicious data.
My site makes a couple grand per month from Amazon commissions. You have to sign up for each different Amazon program separately (.com, .co.uk, .ca, .de, .fr, etc). There is a program for India.

https://affiliate-program.amazon.in/