skysight-inc/HackerNews huggingface dataset:
This advice makes sense given the threat model. However, it might not make sense for someone in Edward Snowden's role. If I were a military agency with a big budget, I would backdoor the shit out of every phone, enforce cultures of secrecy inside companies like google, apple, facebook, intel, qualcomm, at&t, and off any executive that interfered with the mission. Then I would pay experts to spend their lives on internet forums asserting that devices with two cameras, two microphones, wifi that can function as radar, an unremovable battery, a closed-source operating system and root access only available to a major US corporation via ssh, are the most secure computing platforms in the universe. That's just me though, if I had a lot of money and lust for world domination, neither of which I possess :)

Edit: removed sentence "Most mobile devices have baseband chips with DMA"
> Whatever the city charges, the wealthy will pay.

This is extremely unlikely. If it is true, then the empty apartments should be considered money fountains and used to spread prosperity all over the world. Do you mean that they are already taxing to an extent where direct financial incentives to politicians have reached a level that prevents any further tax rises?
we have cities full of $400k empty 1br condos because of zoning regulations on minimum sizes of apartments.

"some zoning rules" is a veeery slippery slope.
Apparently there are alternatives, including an open source one. This video talks about them: https://www.youtube.com/watch?v=lHoOKLWIMKU
What 'average' is being highlighted? Is this an actual average, or a perceived one? Either way it sounds harsh and reminds me of that XKCD comic that concluded there was no way to win 'the game of love'.
Use iOS with a privacy proxy they said...

http://www.falseconnect.com/

The first point being, software flaws and particularly those in low level networking libraries can expose secrets and the key I suppose as covered in the article is to ensure your OS is always up to date. The second point, and Dan covers it elsewhere in this thread, be very cautious about insecure hosted VPNs & you should really never trust proxies which some VPN providers are offering.
Original Author here. If you have questions or comments I would love hearing them.
How to Make Tech Interviews a Little Less Awful
Typos happen all the time - I was going to suggest that it was a bit of an unfair comment. Then I opened up their website [0] and their strapline is "In fraud prevention
Accuracy Matters"...

None the less it is a useful document for those not versed in the basics of opsec and there's likely more value in insightful comments on the content...

[0]:https://www.forter.com
Right click the tool bar in Finder and choose "Icons and text" from the drop down. One can discuss what should be default.
Yes—full details at http://blog.zorinaq.com/release-of-hablog-and-new-design/ Don't forget to lower your TTL to make it work decently.
No, iPhone basebands do not have direct memory access. This is a myth that will not die. The baseband on an iPhone (and on modern Android phones) is connected via a serial bus, as a peripheral. Both Google's and Apple's security teams consider the baseband an adversarial device. This has been true for many years, just as for many years people have been popping onto message boards to confidently inform us that basebands have direct access to memory.
My question would be: what is their definition of "foreign money", and how are they determining how much of it is involved in their housing market.
Software development and engineering is mature? I would disagree strongly. I don't see any evidence that there is a particular established right way to develop software yet. We're still muddling around.

I really worry that if someone tries to establish a software engineering system, then that someone will be unreasonably confident, and probably wedded to a particular method or process. Then we'll all be stuck having to prove we know UML (or the equivalent 2017 fad) inside-out in order to get a job.

Anyway, isn't this what university degrees are supposed to be doing? Maybe we just need a more effective way to shame universities that graduate computer scientists who can't program?
What has beeing smart to do with having money/social status?
Nerds have always been a subject to ridicule.

Regarding the original statement - I agree on both sides. I agree that women(same as men) have some biological broad idea of partner they would WANT to reproduce with. But with time and more experience in relationships, they might compromise.
I...am not even going to go through and read all that. You either have me confused with someone else, or you're on so many levels of prejudging that you aren't actually talking to me. This whole thing is bizarre.
There's a lot of comments basically calling women golddigging p-zombies but not citing any evidence or personal experience here. I think that's more family pressure when it exists.
How can IoT cloud services be made more reliable without excessive cost?
For a remarkably level-headed take on the fallout, I recommend listening to the latest episode of Risky Business [0]. The interview with Troy Hunt gives a calm, informed and above all well reasoned baseline for response.

0: https://risky.biz/RB445
You can't "take in 3 phase and output single phase". That's not how a transformer works. It'd be amazing if it did, as in Nobel Prize winning.

In the US most homes are just tapped to 1 phase, if there are 3 on the pole.
I've been going through a bit of an identity crisis recently. for the best 7 years I've been an xubuntu c++ guy exclusively. Recently I've taken up learning goland and, to make things more interesting, I decided to give the windows dev environment a spin. I've never touched a mac product in my life[1] so I can't compare it with that, but let me tell you, windows means business. you'll obviously need a few things (visualstudio, code and gnuwin32), but the work they put in their flagship products make the experience enjoyable is nothing short of amazing. Yes Microsoft, keep courting me, I'm listening.

[1] except for the original shuffle which is the perfect jogging companion.
I'd much rather the real cost just be built in to the experience. However as a single participant in the market I don't have much real hope of affecting that outcome.
It's either DE-CIX or AMS-IX. I believe AMS have more members and higher average throughput, but CIX have higher potential throughput.
Definitely agreed. But the word analytics means too many different things to too many different people at this point. I'm in favor of more words to differentiate each part.
Best Coffee Maker or Best Espresso Machine
Watch the author write an article in two months: "Why I left Windows for Linux"
"Are you a recording engineer and capable of speaking to the points he makes"

Well, yeah. I went to college for audio recording, and worked professionally in the field, in television and in recording studios, for several years. It's been a hobby of mine for most of my life, and I've always had a pretty competent home studio and I pay attention to the industry even today.
The "self-righting" behaviour can be observed through photo sequences and video captures [1][2].

[1] https://publicdomainreview.org/collections/photographs-of-a-...

[2] https://youtu.be/QxUtFtTaNL4
I think it's a valid concern on employers' behalf as far as opiates and meth are concerned. You do not want to be the manager of any business that has a lot of expensive stuff within arms reach -- whether it's a restaurant kitchen or a Home Depot or a jobsite or whatever -- when one of the employees loses control of their habit, needs cash badly, and commits a spectacularly stupid act of larceny to get that cash. I have seen this play out a few times in friends' businesses and it is not pretty.

With that said, I'd agree it's complete bullshit to be testing your employees to try to sniff out recreational marijuana use. A lot of BigCo middle management are socially conservative people in their 40's-60's, and unfortunately many of them operate from a simplistic baseline of "all drugs are bad"...pretty clear that this preponderance is changing, perhaps not quickly enough.
Thank you very much for your feedback!

I absolutely agree with you! This is one of the main reasons why I created SuperSettings.

I am aware of EditorConfig and I think the greatest strength of it is the ability to configure different editors with one cross-editor configuration file. However, it's greatest strength is also a weakness since it handles, like you correctly said, only general style settings. For example, an important thing for me was the ability to configure the rulers in Sublime Text, which EditorConfig can't do. SuperSettings allows you to configure any Sublime Text setting, so you can, for example, have different color themes for different folders.
With great power comes great responsibility.

If you want raw power, you can buy a car with 500 horsepower. But you handle all of that power, you'll need traction control and maybe stability control, and anti-lock brakes for when you need to stop it. But all of that limits the amount of power you have available, limits your control. Now, a race car driver would look at these driver assist tools and say "I'm sick of people expecting race cars to work like their Jetta and then running into problems that us professional race car drivers don't run into". When you complain that the tires spin or you are having a hard time working the clutch and steering wheel without power assist, they might even tell you "these problems sound more like inexperience with driving race cars than anything else".

And they'd be 100% right. But I'm trying to get to the grocery store, not win the Daytona 500. I want a car with power steering and an automatic gearbox and anti-lock brakes and traction control and an airbag. You may say "computers were designed for power and Linux gives you maximum power!" like the other guy commenting did but I don't want that because when it inevitably breaks (because I'm inexperienced), I don't want to be stuck on the side of the road reading manpages and stack exchange posts with no answers and trying to navigate mailing lists. I have a job to do.

(Seriously, did saying "sounds like you're just inexperienced with Linux" sound good in your head? Because it certainly didn't sound good reading it.)
> Or is there use case for VR that isn't gaming?

Training and design.
Funny thing is I've seen this same typo (security spelled with a missing "c") first hand when reporting a security incident. What made it particularly bad was that it was a mailto:// link that was also spelled wrong so clicking it would send the email to the wrong address with no bounce reply (I'm guessing they had a catch all inbox rather than bouncing bad addresses).

Might want to throw in there a suggestion to generate a security@example.com GPG key and instructions to use it if the submitter feels it warrants it. Also, the usual note of not losing the private half of the GPG key so you don't look like an ass when someone emails you an encrypted security incident that you cannot decrypt!
http://blog.goo.ne.jp/visulsign/e/7fde49c6f81eb40cc6a95f2f57...
Yes, definitely always keep your OS up to date! Even in 2017, this is still a major advantage that iPhones have over Android phones. There will be bugs in any device, and iPhones have a better plan for dealing with them than Android phones. There is a vast amount of empirical data that shows patch adoption rates are far faster on iOS.

iOS patches are:

1) available, directly from the vendor

2) come with new features

3) required for certain apps

4) nag you

etc
No, it's because there are new, low-end PCs that can be bought. There's no low-end Mac, so it means that people who don't want a Mac but don't want to spend as much buy used Macs.

If Apple sold a $400 Mac, you wouldn't be able to give away a 3-year-old Mac either.
>and some say "well, it might have been easier to grasp if the syntax wasn't so obtuse" (which is demonstrably wrong).

Can we have that demonstration then?
I never used the word iPhone in my comment. Thanks for dropping the knowledge, though.
Which he posts from his MacBook.
After seeing positive Scaleway mentions here on HN several times I opened an account to test performance. Damn it was slow, and I had set my expectations very low.

I can understand for a site that didn't need CPU-heavy performance (I intended to use it for a personal Nextcloud instance) but my main issue was with reboot time. Change any settings in the control panel? Reboot needed. Applied kernel updates and need to restart? Wait for that reboot. It was agonizing, I had to abandon the process and check back an hour later to see if starting or stopping the machine had completed.

Even when I decided I was done and ready to cancel, one more wait of 40+ minutes for the machine to shut down so I could delete it and release the reserved IP. I admire the fact that they decided to try something very different, but forcing every customer to copy the entire contents of their drive to a second device and then copy it all back again to restart is nuts.

Currently on OVH for most things (by far the best performance/price ratio for my usage) but still keeping a couple DigitalOcean VPSs due to concerns about OVH's 'special' version of Ubuntu[0], which has me concerned. Hope that's resolved soon or I'm back to DO + AWS as a Plan B.

[0]https://insights.ubuntu.com/2016/12/01/taking-a-stand-agains...
Show HN: Raspberry Pi / Pimoroni Blinkt Library Ported to Golang
Your vision is clearly limited to Germany, where poaching doesn't exist because there is no jobs and no strong companies competing.

Just imagine a random company in a tech hub. They host a meetup once... the days after the meetup, most of their employees have been contacted by recruiters and other companies who attended.

If they want anyone in particular and/or if any employee's salary is not on-par with their value, here they go! :D
Hopefully the fallout is that Cloudflare gets its act together.

Even if your friends know 100% that they can't possibly have been negatively affected by tons of private information being dumped all over the internet, I'm not sure how such anecdotal evidence is any more instructive than a HN "bubble".

Even if nobody at all ended up negatively affected in any serious way, I don't see why people shouldn't remark on the potential effects of such a fiasco when it happens. Was anyone really predicting "the end"?
> Or having each of the fins on a fan be at a different angle so they have a different pitch and fan noise is distributed across the sound spectrum (reducing total perceived noise).

Not trying to take away from the innovation of that idea, but IMO ventilation is one of the few areas where I think Macbooks are strictly worse than the PC laptops I've used. The Macbook I was given for work (13" Pro, 2015) constantly overheats, as there isn't really any vent for the fan to push the air out of. I'm sure it's a conscious design decision not to have a vent (either because it "looks bad" or because blowing out hot air is considered worse than overheating the laptop itself), but I'd personally have trouble counting the way that my Macbook ventilates as a net win in "hardware quality".
Dear god, the timed drills. I distinctly recall the tremendous anxiety evoked by the ultra-competitive nature of those drills in elementary school, and especially the subsequent feelings of failure when comparing my performance to that of my peers.

It must have been that bitter flavor of failure that first inured me against mathematics...it didn't help that the rest of my K-12 education never even attempted to demonstrate the enormous beauty of maths. In fact, until I discovered calculus on my own terms between high school and college, I understood mathematics to be nothing more than the practice of applying rote formulas to arbitrary equations. There was no rhyme or reason to the quadratic equation...it was just one of many "rules" pulled from the mathematical "rulebook," and math was simply the practice of recognizing when this arbitrary rule applied, and then applying it.

Therefore, for most of my life, math was not seen as a creative or exploratory discipline, and in fact the very opposite: One's ability in math was completely contingent on their memorization of rules and simply following them. It was purely robotic, the domain of tightly-wound, uninspired automatons. It was for squares, not free-spirited creative souls like myself!

Though I am disappointed to think of the heights and wonders I could have visited by now, had I been given a proper introduction at a younger age, I am no less excited by the wonders ahead of me, and the many years I have left to explore them. :)
As I understand it -- somebody please correct me if I have this wrong -- the thing about Cloudbleed is that there isn't necessarily any relationship between the site whose page is cached and the site whose credentials appear in that cached page. So the only way to know that a particular site didn't have credentials leaked is to search all the caches of all the search engines on the Internet.

So, as perlgeek says, we'll probably never know specifically what the impact was.
> Assuming most humans having sex is not a recent development, any evolutionary pressures...

Here I think your assumption is factually wrong.
DNA testing shows that it is relatively recent (very few thousands of years)
What really matters is what percentage of the vacant units are on the rental market.

For example in Toronto based on official statistics rental vacancy is 1.2%. 2011 census provides the rest of the required data: there were 1,112,929 private dwellings in Toronto out of which 476,085 were rentals. 1.2% of that is 5,713 units, out of 100,000 estimated vacant.

Imagine what difference on a rental market increasing available vacancies 15 or 20 times would make..
That's nice and all, but the median household income in Toronto is $76k.
Interesting. Yes, though I've never used Win 8 (and don't want to), from the little I had read, it seemed like the idea of trying to merge the mobile and desktop paradigms was a bad idea from the start, and doomed to fail.
If there's anything that people expect to stay constant about Apple is that they will try to tightly control their ecosystem and charge a premium for that.

If Apple just stopped doing those things, I'd consider running OSX, but they won't so it seems like an entirely pointless exercise.

It's the same iOS vs Android debate, Apple charge a premium but promise things will be significantly better, if they are only marginally better then it becomes harder to justify their premium and lock in.

I think the recent spate of articles are more about the fact that the gap has been narrowing significantly, partly due to Apple's neglect, partly due to Microsoft doing better, so the balance is changing for people on the margins.
First poster has a point, no need for people to live abroad and to rent their places to have problems...

Laws in France are really leaning towards the tenants. First there's the "trêve hivernale" which could be translated as "winter truce": from November 1st to March 31st, you are not allowed to evict anyone (unless for safety reasons for instance).

By law, when the tenant ceases to pay rent, the owner must inform the renter through a bailiff about that. Then after 2 months, if the renter still hasn't paid, the owner can go to court.

So really, just at that point, if you did the bailiff thing after your tenant failed to pay for 2 months (because you're nice and didn't do it after just 1), by the time you go to court (because you have to wait 2 months), you're already due 4 months of rent.

The judge has the final call about the eviction delay, up to 3 years. So if you are lucky (not possible) and see the judge at that 4 months mark, judge who decides your tenant should be gone, you'll have to wait another 2 months. Because you can't legally kick out anyone without letting them a chance to find something else: they have 2 months to do that.

So that's 6 months already. I'm sure you can at least add 2 or 3 because courts are slow.

If winter comes, and unlike in Game of Thrones, it comes every year, you'll have to wait for the winter break.

The bottom line is on average, an eviction takes 18 months...

I could add the judge can give a payment delay to the tenant: from 2 months to 2 years.

You can google it, it'll be difficult to find a good translation but:
https://www.french-property.com/guides/france/working-in-fra...
https://www.french-property.com/guides/france/working-in-fra...
I think you're misinterpreting the comments about the scale of the leak. The risk that a concrete compromise would occur as a result was always pretty small.

The bigger thing was the grandiose scale, the impact on administrators in having to rotate a significant number of credentials, and the hit to CloudFlare's reputation. A bug where you randomly dump random data without regard to its sensitivity or origin (i.e., data from completely unrelated sites could've been included in the dump), and have no way to tell what actually leaked, is the worst kind of privacy bug there is, precisely because it's impossible to triage. No one can ever know everything that actually got out.

CloudFlare is now a major piece of internet infrastructure. It's impossible to know that anything sent through a CloudFlare server between Sept 2016 and Feb 2017 wasn't accidentally publicly leaked, and worse, non-trivial quantities of this data were being accidentally saved permanently in search indexes. Surely some bad actors have saved such results in their own private indexes as well.

When CloudFlare says "your site was probably unaffected", they're making a guess, because they have no way to actually tell. They're just assuming that based on the volume of requests your CloudFlare endpoint receives and the volume of requests made to endpoints that exhibited this bug, content from your site probably didn't get out. But there's no way to know.

If we take that seriously, it requires us to consider everything that went through a CloudFlare server as potentially publicized and preserved in the public record (including usually-transparent unique identifiers like session cookies/tokens). We then have to assume that an adversary obtained any and all such data, and respond as best as we can to preclude the possibility of that adversary exploiting the leaked secrets to harm our and/or our company's interests.

Of course, the flip side of the sheer scale of this, and the fact that the bug was relatively rare and that there was no way to control what content it dumped, is that it's very unlikely any of your data specifically actually got leaked.

If you and/or your company are OK with crossing your fingers and hoping this won't affect you, there is probably a 99.something-something-something% chance you'd be right. Most people have responded by resetting tokens/passwords for anything that uses CloudFlare, since that's relatively low-impact and most people were probably overdue for a credential recycle anyway, and have left it at that.

This does clearly illustrate that the internet has a few de-facto junction points, which would be very high-value for an attacker. That's worth keeping in mind.
Ask HN: Investing money for your children
Hi everyone,

I am completely new about investing,and I was wondering what are the best strategies for investing money for your kids (less than one year old).

How did you invested money for your kids? What are you advice on the topic and more important, what should I absolutely learn in this field?

Thank you from a super beginner!

Have a wonderful day and smile! :)

Best,
Domenico