skysight-inc/HackerNews huggingface dataset:
Zendesk. We are thinking about switching to something else (currently looking at Freshdesk) as the service is getting disproportionally expensive with many users.
For more on that story, see http://www.thespacereview.com/article/70/1 (article has two pages, link to the second at the very bottom)
I think I have the same bank, it also asks "what is the answer to your security question" as a security question.
As a developer you should be thinking through your edge cases more than a tester would. The alternative is needing more testing.

Ideal situation: tester doesn't find anything.
Yes, and other people seem to forget that that did not lead to new elections.

Presidential elections happen on schedule. If Trump should leave that gives you Pence, if Pence should leave that will give you Ryan. And likely by that time it will be 2020 and you'll have those new elections but until then you'll be stuck with a Republican as president, like it or not.
The brilliant lecture by John Cleese on Creativity is apt: https://www.youtube.com/watch?v=9EMj_CFPHYc
Full as in "Yes, we're accepting patients, but the waiting list is two years, and we won't see you for an emergency until then."

I had a lot of NHS work done last year. I didn't pay much because I was used as a guinea pig by a couple of freshly qualified dentists who wanted to improve their skills before being promoted to private practice.

One dentist was good, one was kind of okay, I guess.

The deal wasn't explained. It was "And this is the NHS dentist you'll be seeing." Which is maybe not as ethical as it could be.

I've paid for private care in the past and it's never been significantly better. You get more choice of filling/crown material, but the actual work seems to be as good - or bad - as NHS work.

By far the best work was done for free by supervised students at an NHS teaching hospital in the 80s. Most of it has lasted for decades.

The issue with dentistry is possibly that there's no distinction between primary health care - the "have this tooth out or die of sepsis" kind - and purely cosmetic surgery, which is strictly optional.

There's also some overlap with products like implants, which improve looks but can also work better than fillings/crowns.

I can't think of any other branch of medicine which has the same tension between health and appearance.
I do the same thing. I have my crap/spam/don't care account (at yahoo.com). All the accounts that use that email address (which has zero ties to me - though you have to be careful over time not to leak information) also all use the same password. Couldn't care less if anyone ever ties two random and anonymous accounts on the Internet together. My important accounts have huge passwords from a password manager.
Keeping things simple is so key. For anyone working on a SaaS startup I would strongly encourage you to do the boring CRUD method using Ruby on Rails or Django or whatever the default framework is in your preferred backend language. Don't get into the JS SPA world, that's a rabbit hole of decision making you'll never escape from.

You can put that off until you have a successful startup and I bet by then you'll realize you don't need it anyways.

Personally, my problem is that I just have too many side-projects. I have one startup side project, but I probably have a half dozen of other OS side projects that I'm either working on here-and-there or I'm at least thinking about when I should be thinking about my startup.

I think this is one of the disadvantages of doing a startup as a side project while still working full time. Even though I allocate 1 hour and a 1/2 to 2 hours a day to work on my startup I still find myself working on other hobby stuff nearly half the time :( A lot of those hobby OS projects come out of some problem I'm experiencing at my day job but don't have the time to solve in the elegant OS way I would prefer to.

I'm super happy to have read this article and plan to take the advise. No more side-projects, just get my startup shipped. ‍️
What do you all think of this method?

https://arstechnica.com/business/2015/10/this-11-year-old-is...
well I really need to remember part two, for too long I just used an old email I no longer had as my primary account but it does incorporate my last name. time to get smarter. thank you for wake up
If that's why you have a limit then please go and change that immediately.

No, this post is talking about having a minimum length on the password for safety reasons (i.e. a limit on the minimum entropy). You're right that a minimum byte length will ensure this, but what happens when your user types in n-1 "things" but their password gets accepted anyway. That's only a minor thing but (and I'm not entirely sure whether this is possible) what about when your user types in n "things" but the password doesn't get accepted because it's actually only n-1 bytes. Now the password won't be accepted and the user has no idea why.

I agree that these are relatively trivial things, but the point is that it's not as simple as "just use the byte length".
> Fifty-two thousand Americans died of overdoses in 2015—about four times as many as died from gun homicides and half again as many as died in car accidents.

Bloody hell!
>> So insuring against completely predictable events is never worth it unless someone else pays for it, and even then it's less efficient than if they gave you the extra money directly.

It's worth it if the government guarantees it. Dental insurance might not be a good business to be in, but nevertheless people need it. It's a market failure, and it needs government intervention.
Try deleting or moving messages in a folder (sorry, "label") with large number of messages in it (few thousand), then you'll never complain about 2 seconds to open something again...

Like you I'm considering ditching Inbox/Gmail. It's getting more and more painful to work with.
Having grown up in one of these myself, never had a problem with utilities. Some problems with heating - yes. I don't remember piss smell - I remember smell of concrete and fresh paint, but never smell of piss.

I guess it depends on where exactly you lived and what neighbors you had.
If you're worried about a proprietary solution, you could host your own cache server in Australia or wherever your customers are having trouble.
Serious question: given those rules, are there more invalid or valid passwords within those constraints?

At first I thought the answer would be obvious but the more I thought about it and did some scribbling I couldn't come up with a good answer. Math is not my strongest skill.

Let's assume you had hashes of passwords following these rules and knew the hashing algorithm, could the rules be so restrictive they narrow the search space and actually make it easier to crack them than no rules at all?
Extremely large password sizes can lead to a DDOS attack on the server (due to computation complexity curve). A large size such as 4096 characters is perfect. Don't accept a password that is 10GBs in size. But don't limit to MAX 16 characters either.
You are certainly correct that it is common to not pay too much attention to what things are called in the specification, especially if you want to create a fast implementation. Logically you will still go through all the layers even if you operate on only one physical representation.

My admittedly quite limited experience with Unicode is from trying to exploit implementation bugs. And with that focus it is quite natural to pay close attention to the different layers in the specification in order to see where optimized implementations might miss edge cases.

And I am generally a big fan of staying close to the word of standards, if it does not cause unacceptable performance issues, I would always prefer to stick with the terminology of the standard even if it means that there will be transformations that are just the identity.

The distinction between code points and scalar values will for example become relevant if you implement Unicode meta data. There you can query meta data about surrogate code points even if a parser should never produce those code points.
Computer vision research looks for overweight faces
This effect is similar to what is measured when transferring from a WebView (such a Facebook's) to a real browser, since sessions do not transfer. Means the first pageview is considered as a bounce and the second as another unique visitor.

The AMP team is working with analytics vendors to display data as realistic as possible.

At AMPConf on Tuesday eBay gave a great talk how to deal with this phenomenon. Video will be out soon.
A theater group made the news a few days ago when they gender swapped the two candidates in the us election and reenacted a few of the political debates. A comment that often got back was how Clinton's speech was received as completely mansplaining when it was repeated word-by-word by a man.

It is very anecdotal counter example, but saying that men never get exposed to condescending from women don't seem true at all.
Helpscout is awesome. We use their API to put a "Summon Help" button in the footer of our app and auto generate help tickets that are pre-populated with all of contextual information that we need to then quickly solve the customer issues.
Control panel and some of it's applets are available also by right-clicking the start menu. Since w8.1/2012r2, even.
As someone who started a side business with the thought of doing both that and my normal 9-5 until my side business took off, everything you've said in all your responses is completely accurate.

I found out that after landing six clients and taking on a ton of business, myself and my partner (who was also working a full-time job too) got in and suddenly my personal life vanished. Sure, the money was rolling in, but all of my relationships suffered, I didn't have time to do the things I really wanted to do.

Worse yet? I felt like all my clients would want the latest and greatest web technologies and applications to make their businesses run smoother and easier to manage. Nope. They just bickered with me and it was a series of struggles to get anything done. Twelve iterations of design and several "come to Jesus" meetings couldn't stop the non-stop changes for one client. Another client was stuck in a paper and pen world and didn't want to automate or change anything about the one process that hindered their business. Another wanted web design from 1995. It was maddening.

After a year, I fired three of my clients, finished two of the sites and cut those clients loose and then kept the only one that was a joy to work with.

My life returned to normal, but it made me realize exactly what you said. My LIFE is more important than a pile of money. Maintaining my relationships with my family and friends should be more important.
Imposed passwords aren't the only solution. Something like Google Authenticator is an alternative. Or key fobs. Or send a confirmation code to their phone. Or something like Barclays' PINsentry [1] for cards where you need the gadget, the card and the PIN. Or face recognition, which I recently saw demonstrated (it includes liveness checks like asking you to blink).

[1] http://www.barclays.co.uk/Helpsupport/UpgradetoPINsentry/P12...
The biggest issue with passwords is using the same one with the same username everywhere. I knew this, still did it with accounts I didn't really care about (Netflix, Hulu, Skype, etc) and, of course, after 10 years of using the same one, just about every place I used it was getting accessed by someone else over the last few month. Writing down passwords and keeping them in plain site in your house is probably safer than using a username/password combo that you use a lot, on a system any script kiddie can get at.
Why do you think that matters? The sending site knows if it sent an email. The only thing it doesn't know is if you received it.

For an account registration or password reset email, the sending site will typically send you an email with a link inside it containing a secret token. If the JavaScript reads that it received an email with one of those links in it, it will post that information back to the server so the server can complete the function it started (account registration or password reset). Obviously, at that point, it will know if the token it was passed was the one it sent.

[edit] Also, as this system is being implemented from scratch, it could easily be decided that emails which don't pass DMARC for example will simply be ignored. Although I argue that is not necessary.
You don't care about the account, but the admin should. Look at all the compromised account issue on twitter. There's spam everywhere.
4,000 Songwriters Sign NMPA Petition as Copyright Royalty Rate Hearings Heat Up
There is also another problem on how much and how often is Googlebot indexing your site because your site speed is one of the factors of so called Google index budget. My users are in Germany so my VPS is also in Germany to be fast for local user (~130ms for http reply), but for US Googlebot is my site slow (~420ms for http reply). So you are penalized also for this.
Flocker does this: http://flocker.readthedocs.io/en/latest/docker-integration/c...
Can I ask what are the rough percentages of the three types of data science jobs in the industry? And is there an easy way to search for only one type of jobs (such as using some particular keywords on indeed.com)? I have some advantage only in the scientist/stats-heavy type of data science jobs and would like to better focus my job-searching effort. Thanks.
I assume you are referring to the NIST SP 800-63-3, which is quite new (still a draft).

PCI DSS follows NIST guidelines quite closely. Requirement 8.2.3 reads "refer to industry standards (e.g., the current version of NIST SP 800-63.)". These requirements will probably be updated at the next version of the standard (and I hope they will!).
I might be wrong, but aren't there much more registers available in 64 bit mode on intel? That potentially outweighs any memory increase because it can reduce cache pressure. Or is this mostly alleviated by register renaming and other tricks?
I don't actually disagree. But in the meantime I'll take the dental insurance and the tax benefit that comes with it.
That's because those engineers did take their safety margins and unforeseen uses serious and engineered in enough redundancy to make this work.

Obviously there are limits, chances are those limits are fairly well described and if they are ever exceeded it will be ugly.
I suppose I meant high end of the consumer market. I assume this stuff is off in "enterprise" Windows.
I don't understand why I need to use https on a static marketing webpage. No login stuff, no JavaScript, nothing. Just straight up HTML and CSS. Right now I need to pay about $150 every year for something that's only used to satisfy Google PageRank (I can't use LetsEncrypt with my hosting provider). Why?
Totally agreed. It is all about your solution for removing the customer's pain. The sooner you can do that, the better it will be for you and your customer.
Except neither of those is/was true.

Windows 10 has had its share of issues, usually resulting from updates breaking things.

It's also not free. That was a limited time deal for owners of previous versions of Windows. Most future users will pay for it, either as a Retail copy or as an increased price for whatever Windows-based sysytem they might buy in the future.
Also, "If they're adding new features to out parameters, they must be the hot new thing to use".
> Most ideological debates aren't about that. There is no side arguing that government for the sake of government is good.

You can always add more nuance. Ehrenreich had a great piece 20 years ago, "Confessions of a Recovering Statist" with arguments from the left for skepticism of government power. Some people follow that mold and consider themselves liberal-tarians. Some on the right are more hawks, nationalists, or law and order types who prefer strong state institutions.

But speaking in broad swaths, the impression that I get is that most people have a pretty shallow understanding of political theory, and go with the simplest heuristic possible. No fault of their own, it doesn't interest them. They have lawns to mow and bills to pay.

Given that, a better simplification of the current party lines might not drill down into subfactions of parties, but to capture most people, you could get away with something like "I'm on team red" vs. "I'm on team blue."

Short of that, I'm not convinced pro-G / anti-G is that bad of a model for most people though.
>'lose its self-respect'..
What quantifies Facebook's self respect in the first place
There was a larger study done in china a few years earlier with more differentiated results and the correlations are indeed interesting: http://www.bmj.com/content/351/bmj.h3942 . But yeah, not a good article.
I saw http://www.ideacheck.io the other day, so maybe that can help (I haven't used the service myself).
Mods: please remove the 2010 in the title. The publication date is today and the post discusses data from 2017.
But that's the ultimate cop-out. By sheer definition smart people will not do anything stupid. They are utterly incapable of doing stupid things, because then they wouldn't be smart. This is a wonderful tautology and a beautiful way of saying absolutely nothing.
Archiving has always been possible via folders and IMAP. What makes it valuable was the gigabytes of storage space and decent webmail client.
The user who posted this regretted it and asked us to delete it, so we've done so, and also deleted their name from Harj's reply.
I think the issue with dentistry is that half-assed dental treatment is affordable, you just pull the teeth; if you want decent work to save the teeth -- then it gets expensive.
Yeah it was really bad and hurt the brand. Subsequent ones are a lot more appealing and, not kidding, very high quality and effective.

Glad you've decided to take a more mature tack in advertising, but as we all may well know, you only get one chance at a first impression. As such, I don't intend to brow-beat you or your team, just let you know that certain choices have consequences. That commercial was essentially a landmine and if shrapnel happened to take off a limb or two of yours in the process, I hope it's a good learning experience.
however the real world sucks, most field bugs are caused from configurations you would never think of and a ever changing world

i.e. apple just recently decided to break 5 years of responsive design practices by ignoring the maximum-scale meta tag. their decision is not without merit, but suddenly many web applications started behaving weirdly and encountering usage pattern they were never tested on before.

those edge cases never existed before, but I bet only the shops with dedicated testers caught them within the first week.
I tried to work at an Aldi once, back in the late 90's. Their pay was nearly what the local factories made (Chrysler, Delco [electronics for GM], and Subaru a bit further away). They rarely hired folks at full time, however: Most worked 25 hours a week, but I think still had some insurance & vacation.

The most telling sign of the work environment: They had low turnover. Most retail seems to be the opposite.
The user who posted this comment regretted it and asked us to delete it, so we've done so.
Haha just was going to post this in addition :D
What's wrong with the cloudflare free plan? You can host a static site on github pages with a custom domain and use the free cloudflare SSL cert.
Pioneer Jouko Ahvenainen on FinTech, AI, Crowdfunding and Data
I don't understand why you think dental EDIT: care is a market failure. There are dentists people can go to and get care. Pricing is mostly not affected by if you have insurance or not. (Most dentists will just charge you if their rates exceed what insurance pays.)

If you're arguing that "someone" ought to pay for dental care that's a different matter that doesn't really have anything to do with insurance per se.

ADDED: And one actually gets into cost discussions about things like crowns and alternative treatments with dentists. It actually seems like a good model of how healthcare spending should work. Yeah, I have insurance that pays some but thats orthogonal to the cost discussion I have with my dentist.
Top 4 JavaScript code editors
Great concept by military veteran founded and run company. Standing above the rest.
Yeah, why are you using a bad hosting provider?
There's a decent F/OSS implementation called CShell (bad name, I know, that's already a thing)

http://cshell.net/

Either way, neither of them run "true CSX files", but their own homegrown format that predates csx. But it has made me hopeful for the future of C# scripts.
ORMs: The Vietnam of Computer Science (2006)
Keeping it extremely high level:

Among other reasons, not encrypting traffic gives an opportunity for bad actors to replace content in transit to your end users when your end users are on compromised connections, such as rogue "free" wifi networks in airports or coffee shops, or even legitimate networks which have in some way been compromised, e.g. the ISPs of the world who decide to inject other content e.g. their own ads into unencrypted traffic.

The next question is usually "what could they possibly do, change a few pictures?"

They could inject malicious payloads, and for all your users would know, it would appear to them that it came from your site.

> I can't use LetsEncrypt with my hosting provider

Consider switching. For a static site, consider Gitlab; they do a good job of permitting LetsEncrypt.

---

I sincerely appreciate the question, though. I have marketing people ask me this question all the time in private who hesitate to do so in public because quite a few security types berate them for not doing something "obviously" more secure. It's not at all obvious to most of the world's web designers and content creators that a static site should be TLS'd until it's framed (heh) in this manner. The fact that you asked brings about a massive educational moment.

Anyway, consider switching hosts. :)
100% agreed. I used to think that I "understood" this. But as you said it's much harder to do in practice. To anyone else who thinks "oh yeah I know all about that" without having actually done it, don't get so self-confident until you pull it off.
I don't see why one would have only those two choices when trying to feed children whose parents are unable to provide for them.
Here's a link to the setup tutorial too:

https://www.thisnumber.rocks/tutorial
A related interesting topic is the possibility of secure cache servers that don't break the secure channel with "blind caches". Currently just a RFC draft and probably a long time from mass adoption, but nevertheless interesting.

https://tools.ietf.org/html/draft-thomson-http-bc-00, and Ericsson's article on it https://www.ericsson.com/thecompany/our_publications/ericsso...
Great article. Facebook was built in "dumb" php and MySQL! Maybe recruiters care if u know the next big framework, but clients certainly don't!
I run a small web server. Apache Struts CVE-2017-5638
Still there. Actually, even Enterprise edition has it, although labelled 'Security'. There is no off.
Show HN: Data structure walkers for gdb
Here's why: Many ISPs hijack HTTP connections and inject ads and tracking JS into the page. If you don't use HTTPS, your page is screwed.

The Internet is not a safe place. We should aim for HTTPS EVERYWHERE.
I totally agree that arbitrary password rules are not a good thing, they frustrate users to no end, and can make things less secure.

I really liked the zxcvbn library from Dropbox, as it allows you to catch those really egregiously bad passwords before it's too late, but is much smarter than any list of arbitrary rules could be. I actually wrote a similar library (nbvcxz - https://github.com/GoSimpleLLC/nbvcxz) for my company which implements all of the functionality of zxcvbn (and extends it as well) so I could use it on the server side.