skysight-inc/HackerNews huggingface dataset:
>People have an absolute right to be religious if they want to, and to worship any entity, without interference from the State.

Not legally, Freedom of Religion has legal restrictions just as the legal restrictions on speech you acknowledged.

SCOTUS has Entire body of case law brought by "churches" religious worship centers around cannabis and/or hallucinogens - in other words not absolute.

Regarding the absolute free speech folks you identified, I typically find they are they are unlikely to have ever read a single 1st Amendment SCOTUS opinion, generally rejecting the idea they could ever learn anything from robe wearing traditionalist. The real irony is I also find these absolutists also generally start backing down from their opinions once they understand the kind of speech cases SCOTUS hears such as child pornography.
That's easy to check even with just ctrl+f: the last six digits are 422990 which occur 8 times throughout that string. Hence, we could remove at least the last digit without losing anything.
Store it in a DB for persistence, but push it out to application memory. If for some reason you expect your blacklist to be very large (maybe, you have a massively popular API?), push a bloom filter of the blacklist instead of the actual list.

Now, you (probably) only absorb the DB hit on blacklisted tokens.
Technology moves faster than legislation and so it dictates a lot of what the politicians have to make decisions about.

Any country, company, organisation who is not using technology and trying to catch up the to progress of it is loosing. Any country, company and organization who is trying to catch up is seeing itself needing less and less to do the same things.

Technological jobs are more or less the only jobs that pays really well and have some sort of a future and anyone who want to make money in todays economy have to use technology to scale their business even if it means undermining their own value.

The companies who are really transformative today and disrupting aren't just disrupting industries they are disrupting the legal system.

Bitcoin, Airbnb, Uber, self driving cars, drones all push the legal boundaries politicians are represented by special interest groups, these are at odds with the advantages tech brings to consumers.

AI in pushes the need for humans to relearn at an ever increasing speed sooner or later we can't re-educate ourselves fast enough.

Globalization is a byproduct of technology, we can't not have globalization if we want progress, countries who don't want progress aren't going to be able to compete with countries who do.

There are of course many other factors than just technology but it's my belief that today technology is at the core of any human progress. Without it we can't progress and and so we have no choice other than one that ultimately leads to our extinction. Technology is natural. It's part of evolution. If we don't adapt we perish.
> "Buck is a build system developed and used by Facebook."

I have really, really grown to resent this culture of proud and unabashed cargo-culting that we've arrived at in the open source world. Why is this the first sentence describing a new project? Why do we need a Facebook™-approved build system? Does that somehow make it better than the others? And why does Facebook need their own build system? Was the existing ecosystem technically insufficient for them, or was the issue a legal one?

Whenever I make this point in dev circles, someone will reply, "They serve X amount of visitors a day, so they must know something!" Well, they also have a firehose of ad money pointed at them 24/7.
Why is Silicon Valley so awful to women?
Ah, very nice. I like this explanation. Thanks.

From a bit of random googling, it seems that this private/public law principle extends to common law countries, which would include the US. However, it appears that the US may have amended the public law to the effect that mandatory arbitration clauses are acceptable, whereas the EU has gone the other way and made their invalidity more explicit.
DAGcoin was proposed in bitcointalk thread in 2014, long before Iota was conceived and IoT fairly well known.

They dont even use the same underlying technology, unless you consider DAG to be a technology rather than a data-structure. Iota nodes are written in Java, Byteball is all in Node.js

As is usual in cryptocurrency world, if you want news and technical documentation on Byteball, you ask the Byteball people, do not ask Iota, and vice versa.
If we don't encourage that date format then maybe it will go away!
Ask HN: Questions to ask departing CTO?
The CTO of the small startup I work for as a software engineer is moving on to another position soon.

I'm thinking of booking a meeting or two with him to pick his brain before he leaves. I want to find out as much as I can about relevant knowledge, thoughts, and opinions of his that might not have come up in our day-to-day work. (Relevant: I've only worked at this company a few months so far.)

What questions should I ask him?
Because they're Neo Nazis. Not Neo Christians. I criticize the fascist beliefs of many of my countrymen but it has nothing to do with their religion.

Please, hang out with some Muslims. They're just regular folks like anyone else. If more people in the US understood this it would help a lot. It might also show the problems with targeting "Radical Islamic Terrorism" when it could also be "Radical Crime Committed by People With Various Motivations and Worldviews Many of Whom Hail From a Region With a Troubled Past, the Causes of Which are Myriad and Require Some Study of Post WWI Imperial Policy Among Other Things"
On the Security of Supersingular Isogeny Cryptosystems [pdf]
The Dutch Elections: Last Chance for the Netherlands?
Dreamsnap: Real life through the eyes of an artist
The way I understand it is just as he said - reaching out to them on Twitter escalates it to their legal department, not that their Twitter -is- their legal department. As for why and if it's legal, no idea. Although if they advertise their Twitter as their customer service contact, then it could be they made the policy up to bide time /speculation
I have used Bazel (on Mac OS) to build a small C++ project. The nice thing about it is that it can be easily configured to download and build third-party dependencies from github. I have used this feature to add gflags, protobuf, and googletest dependencies to my project. That being said, it is still not perfect. For instance, I was not able to build GzipInputStream and GzipOutputStream (see e.g. https://github.com/google/protobuf/issues/2365).
The last part resolves that, the law explicitly lists that "excluding or hindering the consumer's right to take legal action" in general, and also "requiring the consumer to take disputes exclusively to arbitration" are unfair terms.

The "fairness" part is because the same articles apply to a non-exhaustive (!) list of many, many other types of contractual clauses; coincidentally, most of the things listed as unfair and prohibited by this directive seem standard practice in USA contracts.
I just can't reconcile the fact that if I hit an endpoint, and I get back certain data with a 2XX response code because I previously accessed a "login" resource, but I would have gotten a 4XX response code if I had not gone to that prior "login" resource that I haven't violated REST: my request for the second endpoint takes advantage of stored context on the server. Even worse, if I restart the server, change out its database, or make some other stateful change on it, the response changes. And I don't mean to imply that this is a universal sin of computing architecture, but it sure as hell looks like a violation of REST, and it begs the question of what our standard is. Headers, path-based nomenclature, network layering, authentication - I'm on board with all of that. I just worry that a lot of people might be falling victim to commonplace misconceptions of just what REST is, which in turn may be causing us (the web dev community) to make misplaced value judgments.
Scholarly Publishing and its Discontents
The term is misleading and leads to poor decision-making
It looks quite cool. How do you plan to monetize it into surviving?
You've played a little Logical trick here.

1) shoot a hoop from the middle of the court/equality

No one said being the 0.1% was the goal.

The goal was to be able to have a fair game on the court.

Which brings us to the last part "opportunity". You reduced it to america promised people an opportunity.

This is both illogical (if it was just an opportunity, then in theory no one had to Come from England to america did they) and moving the goal posts.

America promised a particular type of opportunity (the American dream), and the fair possibility for people to attain it.

So it's not just opportunity which was promised, it was a good opportunity, and attainable.

This has measurably changed. The echo chamber on HN may occlude this if you've not really seen other industries or other countries/history.

Finally, I don't know who you argue with. It looks like you've not really had the chance to argue with people who know more than the buzzwords.
A make-like build utility based on Lua
What should I use instead? I pass around JWTs attached to HTTP requests that represent an authenticated user, and contain things such as a user's email, groups, scopes etc. I've tried to keep it simple (RSA, SHA256, nothing interesting), and use the subset of JWT that seems sane (basically the bits I see Google using in their JWT based OAuth flow)

I used JWTs because

1. I like the statelessness of JWTs (though I've learnt that there are many trade offs related to this)

2. OAuth uses JWTs, Google uses OAuth, and Google usually know what they're doing

3. I can attach custom claims

4. I don't know of any alternatives, other than x509, which I have less confidence on me being able to validate correctly than JWTs.

What would you suggest? An opaque token which I then look up against a central database/api?
Sorry, sure.

Emitting colors to terminals is trivial, but ncurses - the dominant text UI library (since the 1980s!) - needs to hold the color information for the "windows" or frames that it maintains for you so that it knows how to repaint things when you switch from one view to the next (eg, if some kind of popup opens and then gets closed, ncurses maintains state about what was underneath so it can redraw it for you. This was novel in the 80s because of the number of competing terminals; see /etc/termcap for a very good idea of why everyone was happy to let a library do this for you).

* The following is my understanding of the situation; I welcome corrections *

Unfortunately, ncurses encodes the foreground and background as an unsigned int, which only stores 0-255. That bit I said before about ncurses existing since the 80s - unfortunately that's more important than I wish it was; ncurses ("new curses") is merely the OSS variant you find on Linux, it has existed on UNIX (as the "curses" library) in many forms. For Reasons™, the commercial curses implementations of the day all tried to stay binary-compatible with each other. Of course, ncurses did the same.

And so, ncurses is pretty much based on a de-facto ad-hoc standard (AFAIK) that's not really ratified anywhere (it might be, not sure) and which specifies very strict in-memory data structures because of the way the API was originally built. Changing any of this would break binary compatibility.

IIRC, ncurses' author/maintainer, Thomas E. Dickey, hasn't really made any noises about for example adding a new function and doing some kind of backward-compatibility dance to allow ncurses to preserve but ignore the legacy color data. I'm not sure if this would actually be technically impossible or whether it's a case of "eeeeh, that doesn't sound like fun, I don't feel like doing that". I can understand the latter, but I definitely hope the former is not true, as it would be the death knell for truecolor for at least the next 10 years - ncurses isn't going anywhere anytime soon, and it would be the canonical way to get the capability popularized.

In case you were curious to see how much depends on ncurses on your system (uses ldd and assumes "libncurses"; unsure if Linux specific):

(IFS=:; for x in $PATH; do ldd $x/* 2>/dev/null; done) |\
awk '/^\//{FS=":";p=$1;}/^[ \t].*libncurses/{print p;}'

There are some obvious things in here like htop/top, alsamixer, dialog, vim, irssi, links, mc, etc; I assume most of what I'm seeeing is depending on ncurses as a result of pulling in another library.

Your package manager's "list packages that depend on this package" may produce faster results.
Does EAA have much presence in China? These guys should be members.
>In a sane society, this man who provides no value to society

You shit-posting on HN provides no value to society either. Now, will you please step into the compost machine, or should we force you inside?
Nice. Though I'm amazed that car parked on the corner, hanging off the pavement all that time doesn't get a prang! ;) Nice parking!
That's the (hope|fear)
Financial regulation is good because it protects people from their irrationality
I think you are overreacting. The first sentence has to introduce you to what you are reading about, and this seems like a fairly minimal description of what Buck is. There are more detailed points below the first paragraph, and a talk available on YouTube: https://www.youtube.com/watch?v=uvNI_E0ZgZU.
Definitely, there's a whole host of potential pitfalls from assigning cookies to the TLD. From the OP's post though it sounded like their issue was one subdomain being unable to access cookies of another subdomain.
When creating Universal JS apps, I usually store a user token as a cookie vs. local storage. I don't think you can server-side render content if you're using local storage.
Palm Beach International (PBI)? <3
What are the odds that this worked? Or, how many digits should we expect to need? Naively, you'd need at least 1 million to get all 6 digit numbers in it. If Pi happened to be a De Bruijn sequence [1], then that would suffice. However, there are only (10!)^(10^5)/10^6 ~ 2e655970 such sequences, compared to 10^(10^6) total random sequences. I.e. the probability of getting a De Bruijn at random with a million characters is about 2e-344030. I'll round that up to "ain't gunna happen". So we probably need a lot more than the naive lower estimate... but where does it start getting likely?

Edit:
Here's another estimate: with 6 million digits, we can get all 6 digit possibilities by just concatenating them all together. There's then (10^6)! ways to arrange the 6 digit strings before concatenating them. So if we picked a random 6 million digit sequence, there's (10^6)!/10^(6e6) ~ 10^(-10^5.6) chance of getting one of those. So the chance that a random 6 million digit string contains all subsequences is at least that high. But that's not saying very much!

This is related to the question: how many balls do I need to thrown randomly into N buckets so that the each bucket gets at least one ball (with high probability)? I was amused to learn recently that the answer must be more than linear in N. You might think that throwing a billion times N balls would suffice, but for very large N it won't. Even though you're throwing a billion times more balls than there are buckets! The probabalists I was talking to about this didn't know off-hand what the exact asymptotic of "enough balls" to throw was. That answer appears to depend upon the asymptotics of the second Stirling number based off this stack exchange [2]. But to complicate matters, the approximation given by the Wikipedia page [3] is precisely insufficient to answer the question! We'd need to know how it approaches that asymptotic.

[1] https://en.wikipedia.org/wiki/De_Bruijn_sequence
[2] http://math.stackexchange.com/questions/174674/if-n-balls-ar...
[3] https://en.wikipedia.org/wiki/Stirling_numbers_of_the_second...
Wouldn't a single client tend to hit just one server anyway?

No? Maybe? It depends on your load balancer. Assigning a client to a specific server is "sticky sessions". Many of us don't want to tie a client to a specific server and prefer a completely stateless 12-factor-style mechanism where any server can serve the client and stateless tokens provide a mechanism to achieve this.
I basically post a warning that says "be aware that someone might attempt this." There's unfortunately nothing I can do about it with the way Syncthing is currently architected. We haven't had any malicious users yet but I'm sure we will eventually.

Fallback is just to provide a static .exe on the mirrors and leave the Resilio Sync node running alongside it.
This article is slightly misleading. One should ALWAYS be suspect of any article that states X is always bad and should be avoided. Google, Facebook, Microsoft and hundreds of other companies are using JWT in security critical software. If you've ever logged into an app with Google, you've used JWT.

All I see here is the author complaining about poorly implemented JWT libraries. It's not a problem with the spec, it's a problem with the implementation. XML-DSIG suffered from a number of similar issues and was arguably less secure than JWT because of the massive attack surface provided by all the specifications layered on top of each other.

Here's how you can use JWT Safely:

1. Standardize on what's allowed in the alg header and validate it, don't rely on the JWT library you're using to do it for you.

2. Make sure you're using a high quality JWT library, jwt.io keeps a list of JWT implementations and highlights gaps.

3. Understand that bugs in code related to token generation and verification can and lead to compromise of your application and potentially your user's data. Treat such code with great care.
Roast Me I've Been a Lousy CTO (Tech Lead Talks)
xmake is a make-like build utility based on lua.

The project focuses on making development and building easier and provides many features (.e.g package, install, plugin, macro, action, option, task ...), so that any developer can quickly pick it up and enjoy the productivity boost when developing and building project.
If you go so far as to maintain a revocation store that is checked on each request, you might as well just use that same store for full-blown server-side sessions.

By your measure, 1GB can store a lot of tokens in memory: 32B tokens + that again as metadata (e.g. user ID + TTL in Redis) = 15,625,000 tokens.
Your abysmal attitude probably contributes a hefty amount to your feelings about this place. You basically just told that dude to go kill himself. What a nice guy you are.
Interesting. It seems that the luxury image is more a burden than an advantage to many manufacturers. But the brand ownership is concentrated and the owners might not care about those kind of difficulties.

I'm more of a fan of utilitarian watches anyways. Sinn for example makes very affordable tool watches that are also technologically on par with many luxury brands.
Show HN: Deploying Your First Clojure App
I don't see why use an assymetric algorithm to encrypt files which is slower and needs to manage public/secret files instead of just using a symmetric algorithm like AES, and store the passphrase in the brain
You're in luck! As I pointed out in the comment you replied to, JWT includes X.509.
Is GitHub now a blog?
I see two reasons for this:

1) Bitcoin transaction fees increasing and ETH being the main alternative available on Coinbase, even though ETH is not meant to be a currency, more like AWS credits, and its supply isn't fixed so isn't a good store of value.

2) Everyone was holding onto their BTC in case the ETF decision lead to a surge of new money into bitcon. Now that is off the table they are seeking bigger returns in alts.

Also new money is being pulling in by Dash hyping their version to those who missed out on the bitcoin bull and since Dash is nothing special now people have the idea that any other alt could be next.
Is this for protest or mischief?
The only way to convince majority of people to conserve energy (or even expend the effort on thinking about it) is to... raise energy prices. Since we want to cut down on fossil sources, the best way to do that would be... taxing CO₂ emissions. Which is yet another reason I like the idea of an emission tax.
Its interesting to see how much Git(Hub) is being adopted outside of software engineering.
Central proposal on p. 98: "What if, instead, knowledge was unbundled from the start and embedded in how researchers actually develop their knowledge? This is essentially what happens with computer code , where programmers are encouraged to use GitHub for their own repository and versioning processes. Imagine that instead of code, it was the experiments, observations, calculations, and so on, that
researchers stored. They could then release those units for “forking” and development by others — all with attribution and updating built in. From that base, they could then write their journal articles linking straight back to the primordial elements of their own and others’ research. It is easy at a high level to think about how knowledge could be unbundled, but once a framework is developed, then graduate students who were learning and reading past knowledge would be encouraged to translate their own information into the new framework. The knowledge could be freed from the bounds of journals without undermining all the curation and
attribution work that goes with them. And at the same time, a searchable database that is open by design would exist not
for articles, pages, or PDFs, but for the knowledge itself."
Show HN: Stochastically generate a March Madness bracket
> Naively, you'd need at least 1 million [digits] to get all 6 digit numbers in it.

How naive do you do it? :)

When I just concatenate all possible 6-digit numbers (of which there are 1e6 = 1 million), I get 6 million digits total. You could of course overlap them partially to save space, but that does not count as "naive" anymore.
Is Silicon Valley worse than, say, Madison Avenue? Wall Street? Hollywood?

Or is it held to a higher standard?
There are people who prefer Gopher and/or particular known sites. If you can see from the URL that a site will be non-horribly designed then that's fine, and if the only option is HTTP then you put up with it.
So the idea is, the last line of each "chunk" of code tends to be where bugs are focused because it's the last thing a programmer implements in that "session" if you will, and they are already starting to be distracted by whatever they're doing next?
Speaking as a long-term collector of mechanicals, I dunno how true a lot of this is for the broad market.

First, an ENORMOUS chunk of the middle-high end are watches with ETA (or other well-understood mass market) movements in them, and not just models from the Swatch Group[1]. Any reasonable-sized city has a watchmaker who can repair one of those. Sure, if you bought a super-fancy watch festooned with complications for tens of thousands of dollars, you probably need to go to a dealer who may ship it back to Switzerland, but that's the exception.

Second, even the in-house movements used by some makes (Rolex especially) are well-understood by non-dealer/non-manufacturer watchmakers. The mainspring on my 1977 Rolex broke a couple years ago; a local fellow I trust replaced it for $200, and that included a thorough cleaning.

[1]: The Swatch Group owns ETA, who make movements, but also LOTS of watch brands you know, like Omega, Breguet, Blancpain, Longines, Hamilton, Tissot, and others. My "Bond" Seamaster has an ETA movement in it, for example.

The tl;dr is that for most watches, you don't really need "factory" parts for repair.
Is the browser on Android in Facebook worse than using the default browser? In iOS, I think Facebook has to use the WebKit web view so it acts the same as Safari. (The criticisms about it being able to more easily/aggressively track you are still true though.)