skysight-inc/HackerNews huggingface dataset:
> Should Google be reporting the addresses of people who search for drugs? Should Facebook be informing the TSA about people's religion?

This is a false equivalence, as searching for drugs is not actually illegal, nor is believing in a certain faith.

A better analogy would be "Should Google be reporting the addresses of people who are distributing child pornography? Should Facebook be informing the TSA of people who are planning to bomb a plane?" In both cases, the answers is yes, and they are almost legally obligated to if they have clear evidence of wrong-doing.
Are there any reasons Edge won't go open source? Avoid too many bugs been found?
My perspective is different, as a resident of San Francisco, while Huston is a scientist in Australia. Though, I think he is essentially right.

These new Internet businesses employ fewer people than the industries that they displace, but these are American jobs they are creating. For (unspecified) reasons the US has a high amount of entrepreneurship, so that a web site running from a desktop in a dorm room can shortly become an international power. The top 5 or so most valuable companies in the world are all American.

When we want a list of the gilded age Internet companies, they are all American. This makes regulation a bit tricky. Germany is trying to regulate Google; where is the German Google? The only competitors are in China and Russia, where the government outright banned Google and Facebook.

This is also a challenge for America. It’s better for us for the jobs to be American, but I don’t want to kill the entrepreneurship. Hillary Clinton told the coal miners to go back to school and reenter the work force with new jobs. They revolted and voted for Donald Trump.
Companies selling stuff much more expensive for the early adopters because they know the customers are willing to pay for it. As long as you're making profit, you should sell to everyone at the maximum price they're willing to pay for. Selling something = maximizing profit or sales, not "making it fair for everyone." You'll see it a lot of that in Kickstarter's tiered-reward structure or processors being sold nowadays.

If a person values my software at $100 and 5 others value it at $20, I am better off selling it for all of them and get $200. If I had wanted to make it fair for everyone I have to set it at $100 which I will get $100, or $20 and get $120.

To give people the impression that I am making it fair to everyone is not hard. I just produce different "editions" of the same software. But under the hood, I don't think it is about making it fair.
I remember using this in a Firefox addon.
Always seemed like a nice thing, but sadly it never became widespread.
It's not like it is a secret, besides, it backfired because I'm fairly even-handed when it comes to privacy, no country gets a free pass on violations.
If I remember correctly, a ton of their original image processing code was written for OS X and it was nontrivial to port to another platform (Might have used CoreImage?), so mounting Mac Pros was the only solution they could find.
I'm in the same boat this author is. It's disappointing to see the desktop market lagging so far behind. For all of the 68k/PPC years, we could at least say "different architecture" and Intel hadn't caught up. Now we're all Intel, and it's Apple that isn't keeping up. It's frustrating, and I'm not necessarily a "Pro user" anymore at all. I have a current generation Mac Mini, and it's over 2 years old now. What I can buy from the Apple Store right now for the same price is what I got 2 years ago.

I wish I know what Apple was thinking. One would have thought that the "iPhone halo effect" was something that they would have wanted to give momentum to. Instead people are looking at Windows units again.
Thank you. I can accept full public disclosure is currently considered responsible, and is standard practice. My question might be too presumptuous, and I didn't mean to suggest hackernoon did anything wrong here.

What I'm really wondering is why there aren't intermediate third party steps between direct contact and public disclosure? Are there no agencies, public or private, that can help escalate the response times? Are there reasons that the security community has come to believe that third parties don't help, or reasons that public disclosure is seen as the safest alternative?
Yes, Palantir is complicit in all kinds of bad stuff. That doesn't mean you should treat their ownership lightly.
testing positive for explosives or poison.

Testing positive for some chemical that might be used in explosives. Otherwise they wouldn't have asked him for what cleaning supplies he might have used.
If you're interested in figuring out what's wrong with TLS configuration on your site, SSLLabs is a much more useful tool. This is for checking if an SSL client (like your browser, but also e.g. a command line tool) is doing something bad.
Side Effects of the Growth of Wealth (1999)
They probably just looked it up on Google maps.
I wrote a blog post a while ago about how JSX relates to E4X if you are interested: http://blog.vjeux.com/2013/javascript/jsx-e4x-the-good-parts...
The whole purpose of your comments then are to kill discussion?
Is this why all the potatoes that I buy now have round, half-moon shaped cuts in them?
Depends on who the buyer is and yes, it does work, there are even specialized marketplaces. You'd still be dealing with the devil but you very likely will get paid.
There were none till recently, but HackerOne seems to the platform that both companies and hackers are using to track security issues, and in a timely manner.

So it's not true that 3rd parties are not helping :)
I'm an average looking, run of the mill white software developer in my late 30's. I still get massive anxiety about taking air trips because of the hassle and harassment I've received in the past from TSA agents.

I have a hope that the backlash against the recent two failed Trump bans will continue to escalate and we'll see the end of this nonsense in our lifetimes. I think even the people who voted for this administration are starting to think it's absurd.
How we built a customer support dream team for our startup
I suppose that whole incident with Weev and AT&T would serve as legal precedent.
Fidex: Filtering Spreadsheet Data using Examples (2016) [pdf]
The privacy implications of this are quite horrible. If you read the Google privacy notice, you'll see that Google tracks and records the activity of your child.

https://families.google.com/familylink/privacy/child-policy/

The reactions in this thread and across the tech community toward Google are just baffling to me. There is a strong double standard.

Microsoft and Facebook are, quite rightly, criticised and scrutinised over the amount and the degree of tracking they undertake. Meanwhile, Google, who capture unimaginably humongous amounts of data on users, escapes any scrutiny.

From ChromeOS (an entire OS that tracks everything you do, and one heavily used in schools) to GMail and Google Analytics and CDNs, Google's digital fingerprints can be found in every corner of the web.

It's no longer an exaggeration to say we live in a time when millions of people are tracked online from childhood to death. This isn't a dystopian episode of Black Mirror, but real life.

I don't blame ordinary users for not fully understanding the privacy implications and the myriad and insidious ways they are tracked. But what excuse does the tech community have for giving Google a free pass on matters of privacy and online tracking?
The UI is straightforward, true. Very simple. That's not the same as good. The comments here indicate that a great many people simply don't understand what they're looking at. That's bad. A straightforward, simple UI is useless if people don't understand what it's telling them.
Lightning strikes have killed 1300 people in the US since September 11. September 11 was a freak event. Terrorism is objectively not an existential threat, and guarding planes does not make us safer. If we were in danger of another 9/11 magnitude attack, it would have happened. Planes are not a magical key to terror plots. Terrorists can easily bomb targets in other ways and be incredibly successful, like Timothy McVeigh.

White Americans cause more acts of terror than Muslims. The last plane hijacking before 9/11 was by a white American. "Muslim" is not an indicator of people from the middle East, much less terrorists- the majority of Muslims are not from the middle East, they're African or Asian. Demonizing Muslims is a completely arbitrary choice based solely on one extreme outlier, and not on the danger they present.

You ask what should have happened. Did we read they same article? He asked to go home. They should have let him go. When he asked to leave they locked him up for 6 hours. He didn't want to be there and they had no right or reason to keep a him there. They treated him like shit, probably searched his apartment without a Warrenton, and cancelled his ticket and didn't reschedule him. And this was at JFK! This is likely among the best, least prejudiced experiences you can hope to have in a US airport. It's one of the largest, most liberal airport; the TSA shouldn't be locking people up if they don't even intend to fly.

I'm white and I once tripped the bomb paper with my shoes. You know what happened? The TSA guy just waved me through. If I was a little browner I would have been locked up in a room for six hours. If I had been treated like this man, I would be in jail for socking an agent in the face.
Sure, they can just threaten to hand off your information to people who will, or will do worse. I'm not excusing the US, but be real, China keeps a file on each other citizens with a "loyalty" score. They're already doing what politicians here merely plan to do.
> Well, mostly a JWT lets you know the user that is signed in.
In my case I'm happy to use non-JWT methods to hold a user's session information (e.g. an HTTP-only cookie) and just want JWT to authenticate with other systems' APIs without needing to centralise auth/auth.

> They're unrelated attack vectors.
Good point. I guess I more just meant that what can malicious Javascript do with endpoints protected by JWT that it can't do with endpoints protected another way.

> JWT's accessed over XHR/etc and stored in local storage are available to any malicious scripts running, meaning they can grab the user's JWT and send it off to their own server, allowing them to make requests as the user.

I guess this answers the above question: the difference isn't in what can be executed in the browser, but what can be shipped to a different server to be used in attacks from there.

To mitigate that, then, how's this setup:

1) User's session is maintained in HTTP-only cookies.
2) Browser can use (1) to request a JWT token (and a refresh key) to hit a 3rd-party API endpoint. The token is valid for 5 minutes.
3) Browser can use the refresh key from (2) to request another JWT token.

Does that pretty much bring it up to parity with using cookies everywhere, while keeping the goal of noncentral auth/auth?
Via http://neverworkintheory.org/2016/10/02/filtering-spreadshee....
This isn't a study, this is an essay about an activity that some people did.
Lots in the States too, usually at regional parks with low traffic. It's not worth it to station someone there, and the people visiting are generally the types who care enough about the livelihood of the parks to attempt to pay. You fill out an envelope and tear off a paper tag to stick on your dashboard as a receipt. In reality, rangers rarely come and audit parking lots for slips, but again it usually actually works.
Shift the economy towards other sectors? That happens all the time. A prime example are oil states currently trying to lower their dependence on oil. What would be the alternative? Not innovate? No, let's not invest in renewable energy, that will hurt coal, oil, and gas producing countries, let's just keep burning fossile fuels? That's just the way it is, the world changes constantly, adapt or fall behind.
I'd argue the opposite. Since no one is catering to them and they're frustrated with all the new technologies they don't understand, the elderly would pay a premium for accessible solutions that bring them value (they're in the stage when they're spending money, not really trying to save).

It's an 'unsexy' problem, and the average young developer/product person can't quite grasp the challenges the elderly have, but it's a significant, severely undeserved market.

If you're (thinking of) working in this space, feel free to shoot me an email and bounce ideas; I've been thinking about this domain for a while.
Male Hasidic Jews have a thing where they refuse to acknowledge female flight attendants. I've seen this at least 5 times.
On mobile

I've had IBS nearly all my life. At 40 it started to get worse, and continued to get worse, until I started bleeding rectally. I started have bad diarrhea constantly, so bad that I was hospitalized for dehydration. Nobody could tell me what was wrong. I started food elimination, starting with dairy and gluten. In 4 days all my intestinal problems disappeared, along with lifelong migraines. Added diary back to my diet with no problems, added gluten, full on diarrhea and rectal bleeding. My wife is a biochemist, so she started doing blind testing, I didn't know what I was eating, my body did, I reacted within days of having gluten. I eliminated gluten from my diet and got rid of my IBS for good, 99.9% of my migraines and I lost 30 pounds I still ate the same just replaced the gluten.

My son exhibited ADD/ADHD signs along with some severe emotional immaturity. In the course of my investigation I read that gluten intolerance is a spectrum disorder the symptoms can vary widely, so I took a shot and switched him to a gluten free diet. He reacted in about 18 hours, he became a totally different person. It was stunning, removing the gluten was life changing for him. His grades changed immediately, just looking into his eyes, they looked different. No more up and down no more over reactions, no more anything.

Gluten alters his brain chemistry and it's noticeable within hours of his eating gluten. We didn't tell anyone at first that we removed gluten, but everyone who interacted with him noticed it the first time they saw him after we switched his diet. His teachers wrote notes, his friends wanted to know what meds he was on. We did blind testing with our son, once, the change was so dramatic it scared us, he eliminated gluten and hasn't looked back.

My doctor and his doctors tell us we are succumbing to the effects of mass media. It's no wonder health care is a mess in the U.S.
Gotcha. I appreciate the reply.

I understand what you were thinking now, but I reject that assertion, at least for my comment. In it, I explicitly accept the possibility that he's right, after warning him that based (only) on the text of his comment, he might not have sufficiently guarded himself against a confirmation bias.

I replied because the way he described it is classic of a "remember this hits, forget the misses" cognitive problem. There's no prospective testing described (other than the initial elimination of gluten from her diet). Their confidence seems to mostly rest on post-hoc examinations of diet once something is noticed (so you're missing most of the data and potentially most of the misses) and even gives himself an out if they do an examination and it does miss (the reference to needing a "deep enough" investigation, implying that he open to chalking up a miss as that this time they just didn't look deep enough).
As I recall from my travels there, in India it would be very cheap to simply hire a guy on the street to run down to McDonald's for you. There are always people hanging around looking for odd jobs.

In general I'm more and more hesitant to assume that since I'm paying someone, they should know enough about me to be able to take out loans in my name. I'm resigned to the fact that e.g. Amazon and PayPal know that much about me, but at this point I would rather not give complete or true details to a restaurant, hotel, or grocery store.
We detached this subthread from https://news.ycombinator.com/item?id=13892152 and marked it off-topic.
> Palantir or a substantial portion of it in the hands of the Chinese (and, by extension in the hands of the Chinese authorities, direct or indirect) is something that you simply should not want.

I don't see why not. China is a live and let live sort of government. They're not trying to export their civil liberties or political system to other parts of the world. They mainly care about what economic inputs/outputs they share with other countries.

Also, why do we care if China have access to Palantir's technologies? I agree that if they have access to the data, that would be a bad thing in terms of national security. But their technology wouldn't be any threat to us.
Not that much friendlier and getting worse every time I fly.
There's some things intrinsic to Lua's design that makes it better for performance & embedding. Take a look at how LuaJIT destroys JS in most benchmarks.

Lua also has coroutines and a few other things that don't exist in JS. JS certainly has the market share and libraries but there's quite a few areas where Lua does much better.
> Also hoping that charging pro rata for usage is something that can be extended to hosting dynos.

All dynos are charged pro rata are they not?
I wonder what made JSX seem like a good idea then.
Can't read arabic :)
This is one of those articles and studies we've been warned about. It doesn't mean anything, and you will be no better off reading it. It is interesting point but it can't be taken as a scientific pointer you should apply for your life.

As a newspaper article, I actually like it.
"800 ms time to first load to 80 ms"

It's a mistake to equivocate TTFB with being 10x faster for the user. It's clickbait. The vast majority of that speedup is not from using static files, but from putting the data on a global CDN (Amazon's Cloudfront in this case - Netlify didn't build their own.)

Put it this way: if you have caching, and a page on your site gets hit 1000 times, 999 times it's going to be as fast for the user no matter what the backend technology used is because it's not going to the backend. So if the first hit takes 800 msec against Wordpress, then the other 999 requests take 80 msec, then using the static file instead of Wordpress only makes it 1% faster, not 10x faster.

For the record, the new Smashing Magazine design is visually complete in about 4.5 seconds: https://www.webpagetest.org/result/170318_MY_PJ5/1/details/#...

The old one is visually complete in about 5.8 seconds: https://www.webpagetest.org/result/170318_T8_Q2D/1/details/#...

So, in both cases, time to first byte is a small fraction of how much time it takes for the page to look done to the user, and by no reasonable criterion should it be considered 10x faster now.

By putting their stuff on a decent CDN instead of whatever the heck "auslieferung.commindo-media-ressourcen.de" is, they made their page 25% faster. That's great! But it's bizarre to see something that is pretty much how Movable Type worked in 2002 as a breakthrough in web performance or technology.

The secret sauce here is using a global CDN, not being buzzword compliant. Setting up Varnish is not particularly hard. Setting up Cloudfront or another CDN is not particularly hard. You could do that and still use Wordpress, if that's what you like.
We were using imgix for a while and were generally happy, but things started go downhill and some point, or so it felt anyway. Their support was always a bit opaque. And the service itself didn't evolve (as far as rendering. E.g. Composing more than one of the same filter wasn't really possible... for example adding two watermarks). We've also had issues with CORS headers that weren't resolved and our end users couldn't get images some times...

We switched to host our own thumbor (open source), and couldn't be happier. We pay around a quarter or less than before (even with failover in place) as well.

We really wanted to use a hosted service. We're not keen on hosting stuff out of our core business. But in this case it just didn't work out.

EDIT: link to Thumbor https://github.com/thumbor/thumbor
> When people can only acquire information from the government, they cannot distinguish right from the wrong. So the lie becomes a truth

Is that really as relevant today as it was yesterday? It seems to me now far more complex and entangled than the monolithic "resist the government system" set out:

In the US, rather than the government controlling the truth, a certain clique of fringe peddlers of a distorted narrative - the likes of Breitbart and Infowars, have done so well as to attempt a hostile takeover of government, and so far are succeeding. Is the name "Infowars" not a self-conscious echo of the sentiment that you quote above? But the content is poisoned fruit.

In the UK, the Murdoch press drives government policy, not vice versa. And has for a long time.
I'm no interrogator, but that does sound like Interrogation 101, indeed. Have different people ask the same questions in different ways and when the subject is at different mental states.
on linux the following might work:

- enter a user and mount namespace
- mount a tmpfs, e.g. over /tmp
- remount everything else as readonly

alternatively

firejail --overlay-tmpfs <command>
In my mind, it's not about prosecuting an individual. The point is to demonstrate that civilized society should, without exception, pursue justice againt war criminals.
Linux Sucks ... For the last time [video]
I agree with you, but at this point it's leaving people wondering if they're almost abandoning the Mac itself. It feels like an after thought instead of a product line.

Not every release needs to be a groundbreaking product, but I'd be pretty happy seeing at least some newer CPUs/GPUs across the product line. Keep up with what Intel has.
Note that this is rather old (2013).
Intellectual humility doesnt get grants though.
Ask HN: 27 year old with a MSc degree in CS. No job experience. Am I screwed?
Title says it all. I'm currently 27 years old. No job experience. Sent over 30 resumes and got 5 interviews. Every interviewer so far touched on the fact that I have 0 work experience. I'm starting to feel like I'm screwed. What do you guys think?
'Innocent until proven guilty' means you don't get detained for six hours when you want to cancel your flight and go home.
I have taken to likening Wayland to svgalib.

The basic task of Wayland is to facilitate that a program (most commonly a DE compositor/WM) can draw on the screen using the GPU without the programmer having to write OpenGL code.
Ask HN: React Native on cross-platform production app? Mistake?
Our app is currently in Meteor (which has been great for its cross-platform (iOS, Web, Android) and hot code push capabilities). However, we are running into performance/UX/scaling issues and want to switch frameworks.

We are debating going native on all 3 platforms or using React Native. React Native has the hot code push and cross-platform advantages, but is it ready for prime-time? This is a production app with thousands of concurrents. The UX and performance is key. Our engineering team has both iOS/Android and JS experience (but no RN experience).
Thanks!
What would a third party do?

If the company is made aware of the issue, either they're fixing it or they aren't.

If you read up on the history of responsible disclosure, it's the result of a long, hard, and occasionally still fought battle with companies who decide it's cheaper to sue security researchers into silence than patch flaws.

Not all companies, but I'd dare say most. Based on that, they're damned lucky they're being given the benefit of 30-90 days.
I'm pretty sure that the original designers of Lua didn't envison that, but LuaJIT is quite nice. I like Lua coroutines but I think JS has practically caught up with generators and other external supports.