skysight-inc/HackerNews huggingface dataset:
Yes, but people want to go there for the jobs, not because they think it has a great urban form. A lot of people would love to see more compact, walkable neighborhoods in the bay area, but old-timer residents often fight zoning changes tooth and nail, because they want their neighborhoods to stay frozen in time.
If you went on Facebook you might be disappointed by how mild the evil is. Holiday pics, cats, people eating etc. There is also an argument for controlling that in a non open way - you don't want the kid photos up everywhere or trolls piling in with threats like Twitter etc.
So if there is no autocrat, how do the collective allocate resources?
If you are not reusing passwords, you should (from a security standpoint) not care at all. Without client-side hashing the server gets a bunch of characters that are exclusively used for that service, and with hashing it gets another bunch of characters.

The only situation where client-side hashing could matter is if you are reusing passwords; but the user can trivially mitigate that by not reusing passwords in the first place.

From the standpoint of the operator providing the service, security is not increased by one iota by hashing on the client. In fact, it can decrease security. By following the NIST guidelines, most up-front password rules are relaxed. However, to guarantee password strength, NIST recommends to do a check against common password lists and dictionaries to guarantee a certain level of entropy. So even if you meet the minimum length check, a password like 'password1980' should fail (common password plus a year). This check cannot easily be done client-side, because from a security standpoint the client is untrusted (especially so with HTTP and HTML/CSS/JavaScript) and it would require a substantial amount of data to be sent to the client (password databases, word lists, etc.). Even without these additional checks, the server still needs to know if your password meets the minimum length requirement. It can only do this reliably by inspecting the password (again, assuming a web browser is the client).

So when you enter a new password, the server should check if the minimum length and optionally the minimum entropy are met. At that point the server already 'knows' your password, so client-side hashing whenever you login normally is redundant.
I'm teaching myself C (pure hobby) and I really liked these codebases:

https://github.com/antirez/kilo

https://github.com/meetecho/janus-gateway

The obvious caveat here is that I have no idea what makes a good C codebase. What I liked in both was I was able to:

compile and run them easily

make tiny changes and observe them easily

read and understand a reasonable portion of them

enjoy the odd comment here and there
I have a kid, and I like the idea of living in a suburb, just not a typical American one where you can't walk anywhere. Being forced to drive everywhere sucks.

I'd love to see more 'streetcar suburbs' with local amenities within walking distance, where parents and kids can safely bike around, where transit to the city proper isn't a cruel joke, etc.
Shameless plug: if you want something almost as cheap but without having to drop the ability to subscribe from all client libs (not just js), queryable history, presence, connection state recovery, webhooks, stats, firehose to queues, etc, then have a look at https://ably.io. (disclaimer: I work there)
Hidden transactions are a problem in any somewhat free economy, whether it's insurance, club dues, auto payments to service providers, or taxes. The usual sales point is that "But you don't have to think about them!" and the problem is that you never think about them -- when you should.

That's not saying taxes should be onerous or deliberately painful -- any more than paying your bank's monthly fees should be onerous or painful. But none of those should be invisible, either. Transactions that are never consciously reviewed are never scrutinized for value. That's no long-term good to either participant in the transaction.
All sectors or organisations being "disrupted" have become slow moving or invested in the status quo. No quicker way to get slow moving than have huge amounts of tech debt.
They trick you into getting one anyways.
If a company hails React as a sane way to develop software, you know where it stands.
It's interesting to note though that they have code quality problems but that doesn't prevent them from being massively successful.
In aggregate, the article may be right in conflating Google and Facebook, as my own view on them is pretty much the polar opposite of yours.

Facebook is oft-criticised for their "walled garden", but it is their walled-garden. Facebook is:

- mostly opt-in (though admittedly there's a huge social pressure to do so for many people)

- I can very easily choose what I do & don't share with Facebook and my set of connections on it (again, this has a few caveats and gotchas. Instagram shares data with Facebook by default, but does provide an opt-out, and Facebook used to allow a kind of 2-degrees of separation data sharing where friends could share your data with 3rd-parties without your consent, but they have since shut this down)

- oddly transparent about their weird, creepy, dodgy activities[1]

- they have a very open and positive (recent) history of relatively large contributions to the open-source community

---

Google on the other hand is attempting to convert the internet as a whole into their walled garden. They are:

- completely pervasive: not only opt-out, but almost impossible to opt-out of. There are thousands of vectors to consider, all of which involve significant compromise of one's ability to use the internet conveniently in order to mitigate.

- the ways in which they track you are not apparent. One particularly grievous example of this was the Google WiFi Location service, which up until recently was sending Firefox and Safari user's locations and WiFi network data to Google (desktop's and laptop's included), a fact users not reading lengthy Ts&Cs would be unaware of. Thankfully initiatives like Mozilla Stumbler are battling this feature now, but there are so many other invisible vectors. Adblockers block Google Ads and often Google Analytics, but most don't block Google CDNs, Google fonts, and many more ancillary services. This is before we get started on Maps and Youtube embeds. You're opting into Google's systems by using any popular website.

- unlike Facebook, Google are notoriously clandestine about their practices.[2]

- Google's contributions to open-source, while massive in scale, leaves a lot to be desired in execution, sentiment and commitment in my view (though there are obviously exceptions). This is kind of a lengthy topic however...

---

TL;DR

- a Facebook account is exactly as creepy as it appears; no better, no worse. And pretty much opt-in.

- Google is invisibly everywhere, it's largely opt-in, near impossible to opt-out of completely. Choice is removed.

---

[1] http://www.pnas.org/content/111/24/8788.full

[2] http://www.bbc.com/news/technology-23002166
Smartphone App Helps Undocumented Immigrants with ICE Raids
I believe "our site works when the engineers go on holiday" thing is not fair. Of course that application is less stable when it's actively modified. There's no way to make it more reliable on weekdays than on weekends except for stopping the development altogether or maybe deploying on weekends.
Show HN: Search torrents without leaving the terminal
From the article:

> The study excluded anyone who said they consumed more than five portions of fruit and vegetables per day, and all participants were told to stick to their normal diet throughout.

So the effect is probably related to any vegetable, not something special about blueberries.

> Before and after the 12-week period, participants took a range of cognitive tests while an MRI scanner monitored their brain function and resting brain blood flow was measured. Compared to the placebo group, those who took the blueberry supplement showed significant increases in brain activity in brain areas related to the tests.

The redaction is very suspicious. They don't claim that they improved in the test, they get some kind of indirect evidence that perhaps is not useful at all.

From the abstract of the article:

> There was also evidence suggesting improvement in working memory (two back test) after blueberry versus placebo supplementation (p=0.05).

This smell as p hacking, i.e. they did a lot of test, most of them were not conclusive, but by chance one of the many variations they test had p=0.05.
You don't have to bet, you can see them here: http://quellish.tumblr.com/post/126712999812/how-on-earth-th...
Inventors and the invention: The Rolling Fluid Turbine
The big thing, as best i can tell, is that gopher is built around exposing a FHS and letting the user browse it rather than mask the FHS behind urls and links inside the documents themselves.

Gopher as a protocol can serve up any odd file format, HTML included, if one so wants.
The kickstarter app is open source and has amazing code quality: https://github.com/kickstarter/ios-oss
I believe, from time to time, you just need to stop developing new stuff for a period of time and dedicate the team to improve the overall quality, pay technical depts, hunt bugs, remove legacy code and refactor still existing ones.
Browsers won't process that request, so for the uninitiated like me:

$ curl gopher://gopher.frog.tips/0/JOB_OPENINGS

* My first ever gopher interaction.
Makes me wonder how their decision for an open-plan office is related with this...
Is zfs able to repair from single data (copy) corruption?

My main issue is to be able to repair a "silent" data corruption on a single drive machine. Am I able to use x% of my "partition" to data repair or do I need to use other partition/drive to mirror/raid it?

If I understand right zfs can detect bitrot ("not really" a big deal) but without any local copy It can't self heal.

My use case is an arm A20 SoC (lime2) to storage local backups among other things, so I need something that detects and repairs silent data corruption at rest by itself (using a single drive).

A poor man NAS/server. ;)
New open source Git pull request tool for code review
Fly, sure... but you can't land at night on an aircraft carrier in 40.
Until the early 90s you couldn't push updates for released software as easily as today, so software had to be launched with a high standard of quality.

Then, after the Internet became more ubiquitous the industry started pushing towards "minimum viable products" that get fixed over time, but can still make revenue. Usually keeping the product low profile with low to no marketing.

But after a couple of years, the agile enthusiasts took over and decided that everything should add "customer value", and everything else should be neglected. The Scrum proponents were also very inclusive, inviting non-technical people to become certified... and that's when things went south and the beginning of the low quality doctrine started.

As digital distribution starts becoming more popular, business people no longer wanted to keep a low profile launching a minimum viable product. Now they want to launch their prototype with full marketing and user acquisition.

Post-launch, software gets bloated with additional features nobody requires, rather than finally fixing long-standing bugs. In addition, developers get the blame for defects and if they want a solution they have to fix them on their own time.

Any non-engineer can become certified in Scrum, and that has had an impact in the way Scrum has been implemented. Suddenly, a certification involving 16 hours of training to pass a 35 question exam with 68% passing score is more important than an engineering degree. Then, the vast majority of people who criticize non-Scrum methodologies has not actually been curious enough to try them and form their own opinion. It is the herbalife of software.

A Scrum certification without a software engineering degree should not lead to a managerial position in software. You can hire the best engineers, but with mediocre leadership results will be mediocre.

It is time to acknowledge Scrum has been hijacked by greed and has produced a huge software quality crisis.
SSRI versus placebo in patients with major depressive disorder [pdf]
Unsolicited messages sent to push a product are spam by definition.
In Germany it is. You may get fined for that and it may get really expensive quickly.
This is what I've never understood about systemd. Somebody will ask "doesn't inetd already do that?" or "doesn't nohup already do that?" or "doesn't runit already do that?" and the answer is always "yes, but systemd does a bunch of other things something else already did too".

shrug

Its setup is way, way too brittle for me, but I guess the QR codes are kind of neat.
It also seems that improvements in code quality caused by React happened not because they were driven by management, but because a few "heroic" engineers thought it was an interesting side-project. At least, that's my impression from the publicly available talks they gave.
That sounds more like computer science than software engineering. At my university, they were different majors, with the focus of the latter being UML and building large inheritance hierarchies, so I imagine SWE means different things to different people.
Are there any examples of seq2seq networks being used for tasks other than NLP? For example, can it be used for something like noise removal?
thanks. I blame it on being not a native speaker :P
I fixed it on YouTube.
These emails were pitching the product to media outlets, and trying to create connections for business partnerships. How would you propose businesses reach out to other businesses and to the media?
"I think 'right sized' armed forces for our needs"

The UK armed forces do seem a bit top-heavy and our record when it comes to procurement is, by most accounts, appalling.
On that note, i seem to recall reading that Fidonet is still being maintained.
It was already out of the bag. That the switch is vulnerable to this was quickly known on day 1 and shortly after posted all over the internet. I didn't leak something private.
Or, quite often, you read it because you want to change it - to extend it or to fix a bug.
firefox for android is really slow rendering pages compared to chrome.
Not to a huge degree, probably, because this is really just America moving towards something a bit more like what's already the dominant urban form in other developed countries. It's not a global trend; while other countries have suburbs, the extent of America's obsession with them and the extreme car-dependence of the American ones is almost unique.
Come over to the ops side. We geezers still get respect here.
I'd also love to hear an update to the "Our site works when the engineers go on holiday" claim.

Isn't this an inevitable outcome once your systems are actually reliable? I've been reading the Google SRE book and they make the same point: every new feature (read: change) is risky. Hence they delay deployments once their "error budget" starts running low.

Seems to me that the only systems that don't work more reliably when the engineers are out are the ones which require hands on deck just to keep them running.
There's the web, then there are tons of other protocols out there to use on the Internet. And browsing using lynx/links/elinks is quite possible.
I am leaving my current team, in part for this very reason. Senior technical people in the organisation don't value readable, understandable code, favouring 150 character one-liners instead. It's proven to be a very effective way of increasing the time taken for anybody except the author to debug issues. In my view, this has increased the perceived value of those responsible.

I'm sure that wasn't their ultimate intention but there's certainly no incentive to change!
Replying to Freak_NL here since I cannot make the thread deeper.

If you are not reusing passwords, you should (from a security standpoint) not care at all.

From a user stand point I agree. But that is not what I'm tryin to argue.

From the standpoint of the operator providing the service, security is not increased by one iota by hashing on the client.

That is not true - it absolutely matters for service providers. If my service verifiably hash client side, and I only ever see the hash, I can gurantee that in the scenario where the database is breached only a hash is leaked. When my service cannot verify, enforce, or reasonably gurantee that users do not reuse passwords, it means that in the event of a breach less information is leaked.

> However, to guarantee password strength, NIST recommends to do a check against common password lists and dictionaries to guarantee a certain level of entropy. So even if yo meet the minimum length check, a password like 'password1980' should fail (common password plus a year). This check cannot easily be done client-side, because from a security standpoint the client is untrusted (especially so with HTTP and HTML/CSS/JavaScript) and it would require a substantial amount of data to be sent to the client (password databases, word lists, etc.). Even without these additional checks, the server still needs to know if your password meets the minimum length requirement. It can only do this reliably by inspecting the password (again, assuming a web browser is the client).

The password list to check against is at worst a few megabytes. Considering that we have JS libs that are larger, I fail to see this as a significant issue. Besides we already know how to encrypt such that I can send an encrypted password to you, where you can, without knowing the key, can verify simple claims about the data.

So when you enter a new password, the server should check if the minimum length and optionally the minimum entropy are met. At that point the server already 'knows' your password, so client-side hashing whenever you login normally is redundant.

If we accept your thesis that we must send the password to the server upon changing it, we could still use client side hashing for a marginally improved security model.
but not chrome, which is the major browser on android...
From looking at the the Java files in the linked tarball as well as the documentation[1], it seems that PicoLisp calls Java by sending serialized messages through pipes from a separate processes and then invokes the Java reflection APIs.

So trying to use this to build an Android app with the native (i.e. Java) Android UI libraries probably wouldn't work too well, right?

[1] http://picolisp.com/wiki/?javacode
> Five years from now, I predict the only three operating systems capable of interacting with the web in any meaningful sense will be linux, macos, and windows; bsd and haiku et al will have been left by the wayside.

That is an interesting prediction. What do you think will cause the BSDs to be left by the wayside in such a short timeframe, when they are more than capable of running the latest browsers right now?

Is the browser becoming a systemd module?

I am a little concerned about the trend to push "hardware acceleration" into everything. Graphics cards and their drivers are the biggest source of grief in PCs for me.
Deep Learning on Title and Content Features to Tackle Clickbait
Git profile v2.0 – Hassle free user configurations for git
> The article moves on, without wondering whether releases regularly breaking your app are a normal part of the software engineering process.

To be fair, that's absolutely their call to make. Nothing of value is ever lost if your platform does not provide any non-ephemeral value.
It's good to have an interim time period. I usually set my rolling To Do list weekly. Early every Monday morning (like today) I figure out what I need to get done, and it gives me a chance to look at the bigger picture. Some people do this monthly, but I find weekly works better.

I use Evernote to keep track of list, but that's not based on any tremendous amount of research. Someone else told me that's what they use, and it's easier for me to find things there than on paper.
What other engineering discipline would say "there's no way to improve our reliability except stopping work altogether"? There's always a way to improve reliability. Arguably, with formal verification, you could ensure large parts of your system are perfectly reliable given simple assumptions.

The problem isn't that it's impossible -- it's that it's more expensive than just hiring one more engineer to keep papering over the problems.
You're saying no one is doing password hashing right, from Google to Facebook to Apple to Microsoft to this very website we're posting on.
I agree with you. This is one of the main issues small-medium scale companies I've worked for have, they just have a dev team that has to keep on creating stuff constantly.

Although I've never worked on a company with the size of FB, and I believe the same logic wouldn't apply to them.
They have to keep creating stuff, as fb still has a lot of potential on becoming way more profitable.
Sounds essentially like GC. And like in GCs, it seems preferable to have pause-free processes than stop-the-world.
Similar here. I use 2 boards, Todo and Objectives. Todo has several lists; Done <Month>, Waiting For, Now, Next & Backlog. Cards moves right to left and each month I archive the done list and create a new one. Things in Waiting For are suspended. Objectives has 12 lists one for each month. I review Objectives every week or so and see if I need to add more stuff to my Todo backlog. Cards in Todo are constantly in motion.

I really appreciate the visual focus of Trello as I'm a visual thinker - I really wanted to like taskwarrior and todo.txt (or just vim and a text file) but I'm just more effective with Trello. The clutter free interface and wide app availability is a real help too. There are a number of nice Stylish mods that can help tweek the experience too.

Pro tip: The tools only help solve the problem. Regular review is the only way to keep the work flowing in the direction of your goals. If you don't do this your work will be dominated by the tasks you get from others.
No way at all? FB has a lot of servers and a lot of users. They have opportunities for quality practices that few other organizations get.

Here's a simple example:

Split the user population into 365* groups. Assign them to days of the year. Test new code only the group whose day has come up. Follow them until they stop having problems. Now you can deploy that to a month's worth of groups. All good? Deploy to everyone.

Yes, that means that you can't have more than 365 changes in simultaneous development. Tough.

*Yes, yes, leap years. Take a day off from deploying.
I read Richard Gabriel's "Worse Is Better" essay in my first month hired as a professional programmer, that was almost 12 years ago. Since that time the lessons of that essay have only increased in significance for me, with this FB story as additional proof.

Their back-end code might be bollocks, and I can certainly believe that judging by how sluggish their FB app feels on my phone, but the fact is that they've conquered the Internet (together with Google and a couple of other companies). It's a fact that I personally hate, but they're still winners in the end.