skysight-inc/HackerNews huggingface dataset:
It happened to me - I was working on an application for the pre-paid electricty system in Texas: the server-side code connects to a data-source over a TLS connection (complete with client-side certificates too), except the server-side used a self-signed certificate, and my code didn't have admin/root rights on the client hardware so it had to use in-app certification verification code. I had to hard-code the root CA's fingerprints directly into my code so it would be baked into the signed binary (this was a project requirement). That thing is going to fall-apart if the root CA ever changes - fortunately it won't expire until 2099.

(Yes, I gave the client a strongly worded statement of my misgivings - and all the other bad code-smells in the project)
I agree with the newly issued certs. The other, that's going to be painful, and a mess to figure out, if you are right.. and that's quite possible that you are. UGH.

EDIT: Update, I'm not sure you are correct, I just downloaded the latest dev release (Version 59.0.3047.0 (Official Build) dev (64-bit)) and it accepts a rapidssl issued(symantec owned) cert valid for 1187 days, which would exceed the 1023 days.

It's also possible it just hasn't made it into the release yet, I'll have to keep like a daily eye on this, and plan to replace much much sooner just in case.
So word processors have to be slow to use the network?

I'm not sure your arguement makes any sense.
> On a per-application basis, you are probably correct. But if the additionally abstraction layers allow ...

Windows 7 boots in approx. 5 seconds to the desktop (if no password is set), and stuff like Word or Visio starts instantaneously. Web applications on the very same computer are a whole different story.

Let's just acknowledge that SaaS is not and never was about any kind of benefits for the user or customer, but just about either centralising resources and services back to the vendor's control and/or increasing money extraction.
Maybe they can't, but that won't stop the people who benefit from high rents[1] from trying!

[1] (And the people they have somehow brainwashed into being on backing them up, despite it being against their best interests.)
Putting one's keyfile in the cloud just seems to me to be asking for it. You're essentially trusting a 3rd party with the keys to your kingdom.
Technically compiler will have more information about the program than processor will ever have. And vice versa, compiler could not know (or very hard to) more than processor about real time info. If the performance is at steady-state, then I don't see why static insn scheduler wouldn't work given sound methodologies.

Old Intel Atoms also used to lack OoO execution.
Thank you for the reminder, I added the disclaimer noting that I develop Easy Passwords.

The claim that vulnerabilities still exist was unsourced six months ago - now you have proof that they do. It would be naive to assume that this was the last of them. As I explained several times already, the issue is a structural one. LastPass keeps the attack surface unnecessarily large and they are pretty bad at securing it.

The recent vulnerability reported was particularly bad, launching an arbitrary external application is really as bad as it goes - this could have resulted in a malware infestation. But the typical threat is "merely" losing all your LastPass data to a random website you are visiting (or a hacked ad script running on it).

How likely it is that bad guys will actually try to target LastPass? They seem to have at least 10 million users judging by AMO and Chrome Web Store numbers. I can clearly see that on some websites trying to exploit LastPass users can actually be lucrative. Whether it will happen to you personally, nobody can tell of course.
It will be an interesting change, for the federal government to use this power for good rather than evil.
If you build a company without thinking too much about diversity and it finds itself unbalanced in race and sex when it has thousands of employees, the math becomes daunting. 10% set-asides would take decades to get you near balance.

This is why extraordinary efforts have to be made, and made at scale.
Not really. By the end of the year with their schedule Chrome 64 will be out with 9 month validity. Then who knows after that. So it is at the most 18 months.
I haven't re/viewed the product/website, but I do want to mention that I immediately pronounced the product name as "H-IVY" (aitch-ivee) in my mind. There may be a stigma associated with that pronunciation.
It was shown on HBO. Season 5 episode 3
yup. I checked my LastPass extension and it had updated and needed a browser restart.
Micropayments, as a rule, don't work because there's too much friction. Subscriptions work because there's a single point of friction once.
Anyone have any more information on the incidents that triggered this response? I was able to find this article on Google's Security Blog: https://security.googleblog.com/2015/10/sustaining-digital-c...

But that's almost 2 years old. Have there been any more recent incidents that I'm unaware of?
Yeah they tried to do the same to me (gaslighting, basically), and I already had a return shipping label in hand, but (un?)luckily they announced the replacements right around that same time.
This happened recently with all my free StartSSL / Startcom certificates. I switched to LetsEncrypt. Also noticing Google and Mozilla's sponsorship.
Just for anyone wondering, as per joshpadnick's great suggestions, you can specify other AWS account's users/roles via Principal in a policy as well. Just use the other AWS account in the ARN. edit: if you want to do so via policies that is

I'd be interested to see your team's workflow for multiple accounts @joshpadnick.
See http://www.infosecisland.com/blogview/21776-KeePass-Vulnerab... and https://www.engadget.com/2016/06/04/keepass-wont-fix-securit...
The story behind Mashape
You mean is it a published policy? Not that I know of.

Does it happen? At least once (personally observed) and I assume more.

They really ought to get rid of comments if they are going to shadowban. An echo chamber of Clinton support is kind of sad at this point and I doubt it fools anyone.

It is their paper and they have a right to publish whatever propaganda they want. And they certainly have been doing that. It's kind of sad to see the major paper of our nations capital sunk to this level but I guess it's the trajectory of big media right now.
This looks really neat - can't wait to try it.
None of the 3 things you said are true. I recommend you get some experience in rendering before you mislead people too much with these kinds of comments.

In reality the problem is trivial, you set up a scissor rect (or explicitly mask the pixels in your shader) and then render only stuff overlapping that square. You don't need to invert the pixels for it to be fast; you can render an arbitrarily nice cursor effect.
Can you name some specific examples?
I had to let go of doing it The Right Way from the get-go, and allow myself to fumble through using suboptimal or just plain amateur setups just to get comfortable with individual tools.

Javascript started as a language for small programs. While it's possible to write well-structured large programs in Javascript, the language does not compel modularity. By default, everything is global. Modules and objects have to be built out of closures. There are many ways to do this, and if you have several libraries, each probably does it differently. Hence the pain level.
I think that really depends on the company. In my company's case it didn't seem to be a problem at all, but we're spread out anyway so people are used to doing things by phone.

On the other hand - and this is anecdotal - at one point I was sending resumes to both Bay Area and Atlanta companies while living in San Francisco. This is after I realized that even if I was going to stay in SF, I didn't want to stay in my current job. If memory serves (and sadly that's all I have, because I lost my job-search-tracking spreadsheet) I had a higher hit rate, in terms of the number of times I at least got to a phone interview, for San Francisco than for Atlanta. It's hard to know for sure, but I suspect that some companies in Atlanta took a pass on me, even though I said in my resume and cover letter that I was relocating, simply because they didn't want to deal with that. I don't blame them.

One nice thing about this sort of interviewing, by the way, is that I could take advantage of time zones and take a phone interview at, say, 7:30 AM Pacific / 10:30 AM Eastern, and then head to work. (Depending on the time zones in question this may or may not work for you...)
Yes, there are different cell and cooling designs for low concentrating PV and high concentrating PV (LCPV, HCPV). But the price of non-concentrating PV systems has, so far, fallen fast enough to prevent either LCPV or HCPV from taking even 1% of the PV market. Soitec, Amonix, Suncore, and Sunfocus all failed to drum up enough CPV business to stay solvent.
Of course its all "plausible" and we all yearn for a Star Trek Tricoder, but spectrometer measurements have to be taken under controlled conditions with careful calibration or else you're going to get garbage-in/garbage-out.

That said, it sounds like harmless fun.

But if you really care about accuracy, its not that hard to assess the quality of fruit and vegetables with your own senses, don't need a spectrometer/iphone contraption.
We are talking about less than 1/1,000th of our current GDP so no, it's not a question of having a larger GDP. GDP is simply not the problem, it's local monopolies that keep getting funded to fix a problem have no incentive to actually fix the problem.

Remember, we rolled out copper wire to every home with a far smaller GDP, doing the same for fiber is relatively speaking a smaller investment.
It's nitpicky and maybe trivial, but I'm happy to see them use the word "Black" so prominently. I always got peeved at "African American." If we're going to discuss race, nationality doesn't really figure into the equation.

Then again, if you start talking scientifically, the concept of "race" is shaky at best, but there's no denying the cultural implications of the idea.
> - Actually finding an XPS with Ubuntu in their shop

Problem is that you're looking for XPS, I think they only do XPS + Ubuntu under their Sputnik program. If you look-up the Precision line, Ubuntu 16.04 from the factory is an option with a $101.50 discount over Win10 Pro. [0]

[0] http://configure.us.dell.com/dellstore/config.aspx?oc=xctop5...
A todo app for the greenfingered. Nice! Might get people talking if you had a social share function... How easy was it to integrate the upload functionality in React Native? And where do the pictures go? Amazon S3?

I posted my first thing to Hacker News today too:
https://news.ycombinator.com/item?id=13938994
Toujours sympa de voir ce que font des frenchies! ;-)
Oh totally, that's the point of the system. I brought up who I perceive as groups most vulnerable to surveillance to address the "most people only care because shame" point. IE the medical data that could be considered 'sensitive' (and negatively impact career potential if more open) could include things like depression/anxiety, high blood pressure for a stressful work environment, etc. I'm generally of the opinion that open data hardens stereotypes, not breaks down walls.
RSA encryption example using `dc` (Desk Calculator)
https://groups.google.com/forum/#!forum/mozilla.dev.security...
5 Creepy Things Your ISP Could Do If Congress Repeals FCC’s Privacy Protections
Wasn't Brave going to use Bitcoin?
Why? I really don't understand why people think that ads of all things need saving.

I understand the desire to make money flow towards the content creators. I understand the desire for free content. I understand that the ads seem to "solve" both of those problems. I just don't understand why people think it's better to keep investing our time and energy into trying to save ads instead of looking for alternative solutions.

So why ads?
Yes, but they're not cheap, in fact they are so expensive that it will be cheaper to cover the mirrors with cheaper cells directly...

At this point in time there are no cheap and easy solutions in sight to make the next 2 to 5% gain in efficiency in a cost effective manner.

But given enough time and effort I'm sure that that will happen, I expect the final cut-off to be somewhere around 25% net efficiency (solar incidence to electricity out of the system) for smaller installations and maybe up to 30% for much larger installations.
And how much RAM does that FPGA hold?

When your entire chip is programmable-logic, you don't have much room for RAM. The MachXo3LF-6900 has a grand total of 240 kBITs, or 30kBytes of storage.

In contrast, the STM32F746G will get you 320kBYTES of storage, 10x the capacity.

At 75MHz and 1-bit per cycle, that's still only 35ms of storage. Furthermore, it'd be a lot easier to program a Microcontroller to compress the data as its reading it, rather than use the FPGA.

The Microcontroller will still get you the Ethernet and USB connections too.

--------

I think this is a job for a microcontroller, not an FPGA. FPGAs are nice and flexible of course, but Microcontrollers offer you far more performance if you're going to use the specific features.

The STM32F746G has GPIO -> DMA directly to its RAM, while the CPU can compress 1/2 of the signal and send it out while the GPIO pins are simultaneously working. That's... pretty good. I have doubts that a cheap FPGA can accomplish all that at the same speed.
This is where Bert Bos (Created jokingly the notorious, unofficial, abused blink tag https://www.w3.org/Style/HTML40-plus-blink.dtd) should have a little "told you someone will need it someday" moment ;)
Have you looked at https://1password.com/? And it looks like https://www.enpass.io/ has similar capabilities, but I don't use it so I'm not sure exactly.

1Password keeps a local encrypted file. The "integrations" are 1Password knowing default locations to look to store the file in the right directory.
Lego’s new Star Wars Rebel Snowspeeder is a work of beauty
Well, my point was it's a bit more trouble to patch something on another planet that it is to `heroku push.`
But why is https://w3techs.com/technologies/history_overview/ssl_certif... saying Let’s Encrypt has 0.1% when https://letsencrypt.org/stats/ says 32 million Fully-Qualified Domains Active?

32 million = 0.1%
32 000 million SSL certs? = 100%

? what?
Let me guess: it is a purely functional university?
I would be super interested to know how Foreign Policy, the Economist, the New Yorker, and other more longform / semispecialist systems are doing. My overall impression is that they are chugging along: it's the mass media which gets caught up in the race to the bottom, because the information being delivered is not valuable.

More prolixly...
Medium, for instance, is not valuable: it's random essays from random people, who, regrettably, often tend to be pretentious (I don't know why). I can get that from forums and subreddits, often without the pretension. I subscribe to the New Yorker: I love their longform non-fiction and their art content. The rest of it I really don't bother with, particularly their fiction. I would probably subscribe to a longform magazine focused on foreign policy / politics / governance with a strong establishment liberal bent. I would not subscribe to a "feed of essays by people of varying qualifications". Hacker News provides that. I subscribe to the NYT. I would judge media to be in a bad way - the people who are educated[1] and interested are already finding serious content and paying for it, and the people who are uneducated and uninterested consume unserious content and often not paying for it.

[1] I use this in a very loose term: say, 8th grade education. Look at the literacy stats for the United States. Nothing to be excited about. But they explain a great deal.
Makefiles are more stable, webpack just went through a breaking change to 2.0.

Makefiles are more versatile, they can be used not just for Javascript files, but for anything. I have a django project that uses lib-fann on the backend, and Selenium for data collection. I wish I had put that into a makefile because I can't remember the commands I used to build it, and now I have to take the time to go figure it out.

Makefiles have conventions for not just building, but also running: "make all" to build, "make run" to run, and if you have an unusual project, you can get plain "make" to print out out some documentation explaining what to do. Webpack has webpack-dev-server but then you have to remember that command.

Ultimately a lot of that could be had by a README file, of course, but Makefiles are easier.
Ask HN: Tools and Ideas to engage with initial users?
I am a founder of rime.co. We recently launched AI-based personal website building platform. I would like to take the feedback from all of our users. Also, we are willing to take more input from our user to improve the platform. What are the best available tools I can use to keep track of my conversation and feedback logging?
Seriously, when your "hello world" example is 150 lines of totally non-DRY code littered with constants and conditionals ... I feel bad for people trying to learn this style of web dev. It's ill-suited to the vast majority of use cases out there today.
I think why there's so much churn in javascript frameworks is that in a dynamically typed system as soon as the framework objects get too big and complicated they become burdensome to remember and everyone starts chasing the next "bloat free" system. Then the "bloat free" system gains features and complexity and everyone gets annoyed and chases after the next thing. Ever wonder why Java codebases last forever and ever without being scrapped for the latest whiz bang every year? It's the static typing and the lack of cleverness in the language. The static typing helps manage the complexity and you can delete stuff and know you didn't break anything because the compiler will say so immediately. This is why Typescript is such a breath of fresh air. I actually get some help from the IDE like I'm used to with statically typed languages.
Symantec being well... Symantec, I'd expecting them to lawyer up in order to delay, or outright block this.

They're big enough to afford the higher end law firms likely needed too. :(
You can never trust an Eton kid.
Hey! Thanks for your comment.
Our pricing is based on the number of employees and admins using the app. For now we haven't witnessed any resistance from companies to adopt a third party service. They find value in our vendors curation and appreciate they don't have to change all their service providers thanks to our system. We grew 40% monthly during YC.
Yes, they redesigned it and shipped out full replacement keyboards. It works reasonably well now.
Digicert works for us. Wouldn't mind switching to LetsEncrypt but vendors are the issue (oh, the joy of approved lists).
Thanks Bambax!
MLconf NYC 2017 Speaker Resources
One account per service per region per deployment stage (e.g. dev, test, production) is the best practice. How you define "service" is up to you, but I usually divide them by trust/dependency footprints.

This significantly reduces the risk that an account-level problem or throttle will disrupt your entire business.

Fortunately, AWS finally seems to be getting serious about building management tools for multiple accounts. AWS Organizations is way better than the old consolidated billing stuff.
Yes? And thats not really a problem at all.
Am I missing something with these machines? I just priced generic Acer and Asus laptops with the same specs to the Lemur, and they both came out $200 cheaper.

Mind you, they come with Windows pre-installed, but the Ubuntu installer will happily reformat the drive before installing itself. And they're all just generic laptop hardware (HID trackpad, Intel graphics), so I doubt that drivers are an issue.
Yup, Saleae logic series also makes fantastic, if a little more expensive ones. The next step up starts getting into the $x,000 range.
Perl6 already has taken steps towards that direction, they have "rules" and "grammars", although I also see that they still call regexes regex but try to avoid the term "regular expression"

> This document summarizes Apocalypse 5, which is about the new regex syntax. We now try to call them regex rather than "regular expressions" because they haven't been regular expressions for a long time, and we think the popular term "regex" is in the process of becoming a technical term with a precise meaning of: "something you do pattern matching with, kinda like a regular expression". On the other hand, one of the purposes of the redesign is to make portions of our patterns more amenable to analysis under traditional regular expression and parser semantics, and that involves making careful distinctions between which parts of our patterns and grammars are to be treated as declarative, and which parts as procedural.

> In any case, when referring to recursive patterns within a grammar, the terms rule and token are generally preferred over regex.

https://design.perl6.org/S05.html

Of course it is not surprising that Perl community is pushing the envelope for regex...
Resurfacing, especially in rural areas, is exactly that -- the existing road is scored and then paved over. There's not enough room there to insert a conduit without actually digging a channel.

I'm not saying that work shouldn't be done, but it wouldn't be a case of just throwing down a pipe during normal resurfacing work.
You are being downvoted, but you are definitely right about the new ones. I'm not sure if they are shipping yet, though.

Details here:
http://shop.lenovo.com/us/en/laptops/thinkpad/x-series/x1-ca...

Previous versions did not have one, afaik.
sh is fundamentally broken as soon as you use a pipe in a command; bash at least has "set -o pipefail".
Not a JS dev, but if I run "ls" or "tar xf foo.tar.gz" and I see "Makefile", I instinctively run "make". Ditto for "./configure", although I'd probably despair if autotools were needed for a JS project ;)
Ditto. It doesn't make for a good _write_ experience, since you have to copy back to Dropbox manually, but I find that I almost exclusively _read_ passwords, so it's a non-issue for my use case.
Replacing 4 story Brownstones with high-rise apartments. Simply removing the politically induced scarcity of zoning density restrictions would achieve that or something similar.

See my earlier comment to this post:
https://news.ycombinator.com/item?id=13940272
Only first hand experience. Tried looking it up and didn't find anything.
True, but there are a slew of security issues (and unknowns) with KeePassHttp: https://github.com/pfn/keepasshttp/issues/258
https://github.com/keepassxreboot/keepassxc/issues/147

I've been looking for a alternative with somewhat parity with lastpass with a better security policy.
Let's Code JavaScript 500th episode, free weekend
Wikileaks CIA Leak – Dark Matter