skysight-inc/HackerNews huggingface dataset:
Ask HN: How do I get freelancing projects?
Hey there,

I recently decided to leave a startup after my vision differ from that of the founders and now I want to freelance to pay the bills while I'm trying to build something myself.

Do you have any tips and tricks from your own experience that could help me get some gigs? Any answer is highly appreciated!

Also, I've mostly done websites and themes in Wordpress, so I guess this area could be lucrative for me now.

Thanks!
> Hence...reasonably well-known.

It's nearly 1,000 years old. It's extremely well known, regardless of the field or context.

It has 680 years on your country, young pup :)
You probably mean "distraction" and "distractive", right? Or perhaps that's just a pun flying by my head. :)
> criminals don't know

This is the best point. Police officers I have talked to advised against using the "Protected by ____" signs and use a generic "Alarm system installed" sign so criminals wouldn't have an idea what you are using. The best criminals can get into anything, and if you tell them what system they're using it's just going to make it easier for them. You can have one of these "cheap" systems but it may take the criminal just as long to figure out how to break into your house "safely" if they don't have that knowledge before.
The shop down the street advertises 72 months completely interest free. Assuming it's not a blatant lie, of course I would sign up for 72 months instead of 12, regardless of what I could afford. That's 60 months of me getting return on whatever investments I make.
I'm really waiting for the ultimate "Programming is considered harmful" article.
If you're talking about just constructing new JS views, creating templates, and styling them, yes I think that will be relegated a WYSIWYG editor for a designer to weld.

I know people said this was going to happen when Dreamweaver came out, but the languages were still clunky. CSS had barely come out and layouts were done by nesting tables within tables. The machine-created code was shit and browsers were wildly inconsistent. Now we have decent browser consistency between Firefox/Chrome/Safari, CSS grids are arriving, and React component web views are gaining more traction. So in 5-10 years, why can't we have an editor that does all this for you?

Yes, there will always be a need for custom interfaces. So a small amount of front-end folks will remain hand-crafting artisan components (and perhaps selling them on a Wordpress-like market place), while other people will either need to move into design/UX roles, or further down the stack.
Downvoted! The title might have changed now, but the original one was completely indecipherable. As far as I could tell it was genuinely some sort of image recognition algorithm for naked buttocks.
It's so easy to get into New Zealand, that it's used as a stepping stone for Australia. Spend 2 years in NZ, get PR, 2 more years get Citizenship. Move to Australia without needing a visa to live/work in Australia. You may as well just hand out Citizenship on arrival.

The government isn't doing anything to make people want to come to NZ to start a business, so New Zealanders literally just pack up and move to the UK / Australia.
This post says "it's insecure if you do it wrong".

Well.....
I did basically the same thing!

https://github.com/bschwind/timelapse-zero

I even have the same carbon fiber case:

http://i.imgur.com/PF5kri7.png

Though I did this before the Zero W came out so I had to have that ugly USB hub and WiFi adapter there. Something is being built across the street from me which is what prompted me to set this up.
Those figures are in AUD. If I worked a full working year, I would essentially earn AUD$850 * 242 (number of estimated working days in the year), or $205,700 pre-tax. That's about USD$154,000 based on xe.com and just rounding a bit.

I work in any fields that need me, excluding gambling or anything immoral or unethical.

EDIT: forgot to say that I work for multiple companies, yeah. I love around once every 3-6 months, essentially.
We have had that sort of thing. Look at Northern Ireland fifty or a hundred years ago, that is exactly what will happen.

And given that Scotland has thrice the population of Ireland, and an unpoliceable land border with England, you would see bombings in England like you haven't seen in 70 years.
I've off and on owned Wacom tablets. None of them were an experience I decided to keep using no matter how neat having a pen interface on a PC is.

Laggy as hell to the point they're unusable to me.
"Send a header that specifies the "none" algorithm be used"

Why would an issuer ever let a client decide what algo to use?

"Send a header that specifies the "HS256" algorithm when the application normally signs messages with an RSA public key."

Again, under what circumstances would a header be used by the client to ask for a specific implementation?

What about encrypted client side cookies - would you let the client "send a header" to specify which key to use???

The only problems you highlighted are serious input validation issues and a naive, broken trust model.
The "none" algorithm set in header is a well known problem and, for example, nodejs most used library automatically uses asymmetric keys when one is given, ignoring the header (https://github.com/auth0/node-jsonwebtoken/blob/master/verif...)

As long as the problem is known to the developers and the key is specified, I think the biggest issue of JWT is the lack of session invalidation (that is, if you log out your already emitted tokens are still valid until their expiration), but it's a good tradeoff for not having server sessions.
> Stop programming like your grandfather did.

Actually those that had family members working at Burroughs, ETHZ, DEC, Xerox PARC, Texas Instruments or Genera, probably should start coding as their grandfather did. :)
JWT is bad, signed tokens are fine. Session cookies suck and don't scale. Just copy code of MessageVerifier from Rails, it's simple.
Show HN: Smokesignal – chat via apache logs like xkcd1810
The article mentions at least one of them can't read or write. Would be an interesting challenge to build a knowledge sharing platform in that case.
I assume they're asking themselves that question now. Probably it seemed cheaper up front.
You're strawmanning me.
I never said anything about the US being destroyed by immigrant or a stealing of territory or resources.
In fact I never mentioned the US.

The comment I responded to was:

> universities have limited classrooms and labs to fill. A country is not limited.

That's factually incorrect. A country is limited in a lot of ways.

To be honest I think that your definition of "immigrant" is biased.
... yes, but... sidenote, JSON is almost unreasonably easy to grok, and translates well into every web-abstracted language, making it the clear-and-away winner.

At the end of the day, tech doesn't win. Developer experience wins. By the time companies have the resources to fight for every iota of performance, they've already won because they shipped product faster than everyone else --- why? Their developers could move and iterate quickly.
How to plan you knowledge base content
I'm part of the Ethereum community and I think immutability is vital for its success (immutability is the core value proposition of public blockchains). I also think the DAO was early enough in Ethereum's life that it could be hard forked without seriously discrediting Ethereum's promise of immutability.

There's a huge difference between a blockchain that just started out, effectively in its beta release and learning the ropes, doing a hard fork under extraordinary circumstances, and a mature blockchain doing a hard fork to reverse any old major Dapp hack.

If Ethereum does hard forks to reverse hacks of third party applications at a mature phase of its life, I think its chances of succeeding and becoming the main platform for global asset management will diminish significantly. On the contrary, if Ethereum stays true to its principles, and becomes reliably immutable, even in the face of major hacks, I believe there is very little that can stop it from becoming the defacto protocol for global commerce. So I think being overly pragmatic is actually dangerous. Idealism is what sets principles, and principles are what give a platform credibility.

Remember, a hack of a third party application, no matter how major, cannot seriously harm Ethereum. A contentious hard fork and a discrediting of its principles can.
Isn't there a risk that reimplementing a previous employer's tool constitutes a legal/contractual violation of some kind?
> Nitpick: The City of London is not particularly central

It is if that's where you go most of the time. I only rarely go west. Mayfair was once described as a nice village on the outskirts of London
Many successful companies run the worst software you will ever seen. Yesterday there was a post about MUMPS which got me flashbacks of clients that showed me software that ran their entire 100m+ euro / year factory mostly written in MS Access / Excel on a shared drive (with the lovely locking Windows does!) mostly (this particular client had some CRM and an ERP from Dutch companies 'laying on the shelf' but 'never got around to it'). One of the biggest EU factories that creates the belts for conveyor belts runs on the worst PHP code as ERP I have ever seen. Many sites that are not Google or Facebook etc run on hacked together crap in whatever language and tech and do fine.

Twitter was crap at the start, most software in electronics was beyond unusable until recently (in some systems) etc.

You can of course lose because of sloppy software, but if your marketing is done well, I don't see why that would happen. There is an enormous overestimation how much people care about that kind of thing here on HN. From the first decade of the Windows versions to tons of Twitter outages after the launch to getting their computers hacked, passwords stolen, CCs stolen, privacy taken, slow as molasses systems, forced reboots, many crashes, bodged updates, forced updates, virus/malware scanners taking up 50%+ of your /still too expensive/ resources too much of the time, really bad iteration of the Facebook app at the moment (at least on Android), broken airplane booking forms, 404 support pages etc etc etc and yet no-one goes away because most people curse and move on to whatever. Unless your marketing is bad aka no-one uses it, it usually won't fail because of sloppy software.
Dramatic footage of free diver and killer whales in the Arctic
The difference between name (...Clouds) and address (...cloud) really triggers my ocd.
No but parity archives solves a different problem, with only some percent of wasted storage you can survive bit-errors in your dataset. It's like reed-solomon for files.

In order to achive the same with ZFS you have to run RAID-Z2 on sparse files.
The KISS principle, a developers must
How about sharing the output via WiFi / Bluetooth?

That seems quite risky tho, once the device is infected, that would be like washing all your dishes with the toilet sponge.

What is the goal of having to reboot at each cycle?
Unfortunately, I never had the chance of using a Palm device of yore. Palm still has a following, as does Newtons due to how historically they solved a problem so smoothly no one since has been able to copy it. I'm willing to accept that ye olde Palms could meet my requirements of usable.

I don't think the silicon valley today understands that everything must be UI/UX oriented. If your UI/UX is broken, I don't care what your product does, I don't care how much it can improve my life, I don't care what you're telling yourselves or your investors: your product is broken and unusable to most of your customers, to every customer who isn't willing to put up with the brokenness.

As a customer, I don't need you, you need me.
Munich: The Silicon Valley of Europe
If you want a watch that looks like a Russian oligarch just curled up around your wrist and died, you might be interested in the latest model of Rolex’s Sky-Dweller.

Beautifully written.
Atheists at risk of dying out due to belief in contraception, study claims
But I think rendering is a specific kind of programming problem that allows simple mathematical reasoning (even if the equations are complicated). To state it differently, information is only flowing one way, i.e. from the model to the display.

Documenting a general computer program is much more involved.
Also a Programmers' Word Processor, indirectly: Borland editors (Turbo Pascal, Turbo C, etc.), JOE, and others, took many of the WordStar key combinations... [1]

[1] http://texteditors.org/cgi-bin/wiki.pl?WordStarFamily
I hear where you're coming from... but this is also the bane of developer existence. We all have to accept that, every year, tens of thousands of new developers looking for jobs enter the market. There's such a demand for developers that these people get jobs. So footguns, as much as we like to play high-and-mighty and say, "well, duh, don't shoot yourself in the foot" are a real, existential risk to a lot of companies.
Tortoise/hare loop detection also works pretty well for short-cutting Mandelbrot set iteration :-)
I believe they mentioned business use. They are getting reimbursed by their employer.
> At Facebook, everything builds with Buck (and Google with Bazel I hear).

Surely not on Android or Skia teams, unless they internally use something other than what AOSP and Skia use.
I would have expected a more in-depth analysis of JWT compared to other techniques. As much as I appreciate the effort to warn people away from bad security practices, JWT is not as a technique fundementally broken.

> JSON Web Signatures Makes Forgery Trivial

> 1. Send a header that specifies the "none" algorithm be used

Most JWT libraries require you to explicitly allow the none algorithm. I had to set a very explicit system property to even get the library I am using to accept none! Even so, anyone implementing JWT should make sure that only the algorithms actually used are accepted.

> 2. Send a header that specifies the "HS256" algorithm when the application normally signs messages with an RSA public key.

Being able to use the public RSA key used to sign an RS256 JWT as the key for a (forged) HS256 token requires the server to accept both RS256 and HS256, and (critically) to be able to use a key configured for RSA assymetric signing to validate HMAC SHA256 signatures. I have not been able to reproduce this latter bug with the library I am using, but even if it did, I still check the algorithm field beforehand: if a token claims it is HS256 signed, I use the (private) key configured for that (if HMAC SHA256 signing is allowed in my application); if it is RS256 signed, I use the (public) key configured for that. The library I use doesn't even get a choice in this; it either receives a JWT that claims to be RS256 together with a RSA 2048 public key, or it gets a JWT that claims to be HS256 together with a private signing key exlcusively used for HS256.

The code preforming those checks between the REST-call receiving the JWT and the JWT library is trivial.

This is all assuming that you would place a service configured to accept both HS256 and RS256 tokens at the same time in production.

As with any security standard: don't use crap libraries; do your research; test your service for common vulnarabilities; follow recommendations made by experts; and don't deploy techniques you don't quite grasp in production software.

> JSON Web Encryption is a Foot-Gun

So is TLS, or hashing passwords. Security is hard and requires a lot of reading and grokking (but it is not too hard for any moderately experienced software engineer).

> TL;DR

Really? 'Too long; didn't read' for a handful of paragraphs? I'll grant the author this much; anyone who can't muster the attention span to read that much text without groping around for a single sentence summary shouldn't be implementing (any!) security standards.

JSON Web Token is a well-documented accessible security standard with a lot of comprehensive information available. As with any technique, there are caveats, but these caveats do not discredit the technique as a whole.
Why would anyone still use WinRAR (probably without a valid license, too) when there are free and libre alternatives? (7zip comes to mind, and there were others before it)
That's great. But until we see these new libraries included in C definition, how new users will know that C is live? I think C11 is the last C standard, that is almost 6 years from now. Feeling sorry for this amazing language.
Make an App, from Idea to Release
Personal opinion inbound...

This will never happen.

Public opinion will be completely against any proposal to do this. Partly NIMBYism, but also legitimate fear of a bungled process which exposes the public to radiation risk (e.g. a truck/ship crash). This would also potentially tarnish the international brand of Australian tourism and agriculture industries, which both like to project an image of a clean and protected environment.

Any smart politician will recognise the nightmarish public relations battle is not worth the reward for them personally, so the project will never get a fair hearing to begin with.

Personally I would support the establishment of a nuclear waste facility in Australia in principle. But I don't think it will happen unless our economy goes right down the toilet and we become significantly more desperate for funds.
Youtube video? My laptop is having trouble with WebGL.

EDIT: Nevermind, FF worked.
If a similar study would claim "Christians at risk of dying out -- Muslims are having more babies" I doubt it would have made it in mainstream papers.
> Getting them networked might dim the romance a little, but it also might mitigate the tragedy.

True, it would result in a mixed experience.
I think that's fair, I just also think that the price to me feels about the same ($5/year or $5 for some unknown number of years), and would give you some ongoing money rather than a block at once then regular maintenance, while at the same time limiting the runway you'd need to give people while still fully providing them with the service they paid for / you could always refund the last year and it wouldn't wipe out everything.
> The poor have only their labor to trade with.

In fact that's what we all trade when we move to a foreign country. The general rules are to have enough work experience in your field or a degree, and you will need a proof that you're going to work or study. That applies to everybody.

> destroys their lives just as much as slavery can.

Ok, I don't know what to say. That's just purely disingenuous.
One big missing feature in typeclasses is overriding. You can't "call into super."

A concrete example: you make a new type in Haskell, and you derive Show so it can be printed. But the default output isn't quite right - you want to add something to it. In an OO language you might "call into super" and append to the string. But in Haskell this isn't possible: you either get the default implementation, or you do it all from scratch.

More generally, typeclass default implementations are a lame replacement for overriding, and existentials are anemic compared to dynamic binding. This pushes Haskell interfaces towards rigid, static designs. That's fine if that's what you want, but let's not pretend it's equivalent in power to OO polymorphism.
The "response by Ralph Johnson" link is dead: http://www.cincomsmalltalk.com/userblogs/ralph/blogView?entr... :/
Startup SkipTheDishes cancels job interview because applicant asked about pay
I'm a fairly experienced backend and web developer. My first experience with RN was exactly this.

During 24 hours at a hackathon I was able to build an app that would show a live view of the camera, capture 5 frames a second to be analysed by an external api, overlay recognised food items on the screen, send it all off to the hello fresh api and display a list of recipes to the user that would use the most food items from their fridge.

The fact that I was able to accomplish all of this in 24 hours with no prior RN experience is just amazing to me.
Leafless – async-await, es6, http library
Maybe it wasn't about the money and he just wanted to continue working on autonomous vehicles on new terms for a different parent company, without losing all the previous work.

This is also stealing in my opinion, but it might be a little more nuanced than for pure greed.
Many years ago I did a little utility I called autobuild[0] to do similar things. It has osx and windows support, but never got around doing linux support. I don't think inotify has an easy way of doing recursive filesystem notifications, having to manage the hierarchy and their notifiers, so it lapsed when I didn't need it at the time.

It felt like this kind of tool would/should be one of those standard command line tools always available, or the at least of those standard things everyone knows to install, like silversearcher/ripgrep etc.

[0] https://github.com/scoopr/autobuild
> We're defining

Who's We? Shouldn't taxi drivers be free to define how much they want to sell their time? Why should you decide for them? Isn't that paternalistic and anti-freedom? Why do you know better than they do what's best for them? Why not let them be?
>> A lot of developers try to use JWT to avoid server-side storage for sessions.

This is based on what? Sounds like he just made it up. His other claims does not look sound to much more either. I would like to see a more in-depth analysis on the subject, this all looks very hand-wavy to me.
Do people easily understand these transmissions? I always think there must be something wrong with either my English, or my ears because I barely understand a number here and there, even with headphones.
> The only problems you highlighted are serious input validation issues and a naive, broken trust model.

If these things are suggested in the standard and promptly followed by major implementations, then the standard isn't very good.
Exactly. The session invalidation has to happen using a session store or expiry header or something similar. In this regard JWT is not better than cookies.
Yes, we had the same email today. Their support email address bounces right back. One to Sales didn't but I have v low expectations of getting a reply. Can't find anything on their site or 8x8...
Session invalidation is possible though, by maintaining a (short) blacklist of tokens on the server. JSON Web Tokens can be given an ID (via the jti claim), and server-side these IDs can be matched against this blacklist. When you log out, you send a request to the service that your current token be blacklisted.

Because JSON Web Tokens are short-lived, the blacklist need only contain tokens valid for validity period plus a few seconds and remains very small (often empty).

If you use JWT to allow authorization on several server, then you do need to distribute this blacklist, so it is not a completely trivial solution. In the simplest scenario you might suffice with only maintaining a blacklist on the server that can refresh tokens (this means that when the token expires, a new one cannot be automatically acquired).
I was looking into getting one and according to CDW the Sony Digital Paper was discontinued January 17.

My fear with the Remarkable is that they will try to require a monthly subscription to their cloud service in order for the device to function.
The model has been considered for Syncthing many times, but it boils down to the fact that:

1) There's no way to revoke access, and
2) Once the secret is out, it's out: you have to scrap it and start again from scratch.
Technological debt – everything you need to know
But they aren't. Nobody is suggesting to anybody to use NONE as the algorithm.
Can you elaborate on your first sentence?

I've been using headerless JWTs for stateless API authentication and authorization (JWT without the first segment), but the work is preliminary and I wonder if I'm doing it wrong.
Agreed, but in this specific case, CIRCLean depends on the keys being inserted before boot (see steps 2 - 4).