skysight-inc/HackerNews huggingface dataset:
I think the gist of his argument is to not be ashamed of your work in the face of criticism. He's not advocating a lack of passion, just to not let the critics get you down.
Promoting Positive Climate Change Conversations via Twitter
What is your development setup like? Do you have the hololens on while you are developing for it? Does the hololens do all the things a desktop computer can do, but in AR?
Servo doesn't even support SVG yet, and I can remember how long it took Firefox to get SVG animation once plain SVG was in there. One can hope things will go faster this time around ;-)
The attacker who gets access to the filesystem of your
phone can almost certainly defeat any "encryption" a TOTP
authenticator would use to protect secrets

Is Android's hardware-backed keystore no good? The documentation makes it sound like keys can't be extracted or used without user authentication.
This is something that Google is actively working to prevent, see https://en.wikipedia.org/wiki/Google_(verb)#Etymology
I had some crazy notion that maybe the guy would use his gray matter and realize that water is not very dangerous and would maybe let me sneak through with some water because water is not very dangerous. Live and learn, I guess.
Whether or not a person can work in the US or Europe will require research and the only person who is likely to go through that effort is the person who wants to work in one of those places. I might read something about the emigration options of Indonesia's residents, but I'm unlikely to research it.

Following people on Twitter and posting to Hacker News is probably easier than doing the research and paperwork that is required to emigrate from Indonesia. It's probably easier than working with clients or building a SaaS. Partly this is because posting online and using Twitter successfully is the normal case and building a business and relocating around the world successfully is the exceptional case.

Doing the hard things means risking failure in addition to doing a lot of hard work.

Good luck.
It doesn't matter how good it is, because once the application is used, the (now-resident) attacker gets the (now-unlocked) secrets.
Yes but you didn't address the main rebuttal, which is that encrypting or not encrypting the TOTP store is a red herring. If someone has access to the filesystem they can likely walk around the issue of encryption, just as they would on a desktop computer. And if they control execution, encrypting the data becomes utterly moot (and I'd argue most cases of someone gaining filesystem access where the individual cares enough to have 2fa are going to be a jailbroken device, which results in complete debugging and reversing capability, which makes this redundant).

This is not the thing to optimize for. Yes, optimize for ease of use, because take PGP as an example of great security vs horrid usability and look where that's got us. If you do the security improvement analysis from a cost/benefit perspective, you do not win by using a hardware key over regular 2fa apps. Users will shoot themselves in the foot, or simply not use it.
> webassembly.

is basically a better way to do ASM.js . How many Python,Haskell,Livescript have been built on top of ASM.js ?

Do you really believe you can make your users download 10s of megabytes of binaries each time they visit a website just to bootstrap a language? And i'm not even talking about the runtime...

Right now, the only viable languages for webassembly are the ones that don't use garbage collection and have a limited runtime, Rust,C and C++ .
I have Yubico Authenticator installed on my phone and my desktops/laptops.

The android app is a direct fork of google authenticator and has nearly identical UX.

I tap/plug my key to either of them to get a token.

If you want to make the argument TOTP via hardware token is overkill for most users, that is totally fair. On that note though, there is no point in having hardware token via U2F.

Security is ahout the weakest links. All I am saying is anyone going through the trouble to set up U2F as this guide suggests, might as well spend the extra 10 seconds to store their TOTP secret on the key as well, vs exposing it on the phone.

I assume someone that has a hardware token is getting it for a reason: To have assurances an attacker can't log in as them without that token.
Seven Reasons to Choose Node.js for Your Startup
I remember reading a 'lessons from a developer' type e-book a few years back.

And he said something like...

1. Don't underestimate the time you can waste on Hacker News

2. Don't underestimate the value you can get from using Hacker News
I'd say tour.golang.org is quite good. But the most important thing I feel for C# devs is to know that there is no Visual Studio like fancy IDE for Go.

People may be debate merits/demerits of this situation with valid arguments. However if you are in everything IDE camp Go might just not suit you.
Customers love it. It a huge wow factor when you bring it into a place.

Positive:
Voice Commands,
No Computer needed,
Unity is great - development is easy

Negatives:
Field of view is just weird,
Not as intuitive as it could be,
Cannot sell it - dev only
> How come that's legal?

Because states have passed laws to that effect (like the one in this article).
Uber allegedly used secret program to undermine rival Lyft
This decision is getting a lot of hate here in Alabama and I'm surprised to see some support here. The knee jerk reaction is to think this a separation issue, but its really not. States can delegate authority for law enforcement to anyone they choose.

With that being said, its still a dumb idea. Our government is wasting time debating this issue when there are so many topics that are real issues. This church could hire full time security people or outsource to a security company. My alma mater had a university police force, but decided to contract the local police instead because it was more cost efficient.

And Christ never said life was going to be safe. He actually said the opposite.
"Garbage collection, for example, introduces nondeterministic
delays. Automatic memory allocators complicate common kernel
optimizations such as slab allocation"

No no no. Badly designed GC, for sure. But for any modern, thought-through GC this is not true.

And in any case, the Linux kernel uses ref-counting all over the place, which is the worst form of GC - slow, hard to debug, full of potential places to trip you up and cause a leak or a security bug, ...
> almost every basic function needs to be imported from some third party, which also feels not so safe, as a sys admin

Go (and most languages) also supports importing a lot of packages from third-parties. Just pin your dependencies to specific known versions and do hash verifications.
For virtually all users, their iPhone is in fact the most secure computing device they own. It's meaningfully more secure than a computer running a desktop operating system. If we're talking about protecting applications running on a desktop OS, the idea of keeping things off the phone because "phones have exploits" is pretty silly; in that threat model, the desktop is also owned up, and with it the email account --- it's now secured solely by a cookie in your Chrome cookie store on your compromised desktop!

The threat modeling here just doesn't make sense.
That doesn't work for Google Authenticator. Apps can opt-out of being able to be backed up, which even prevents adb/helium backups (unless you're rooted).
On topic question:

Anyone know how well flexbox polyfills work? I went to this website in IE10 and it is unusable (as I suspected).

I would love to use stuff like this but until it works at least 2 versions back in browsers I don't see how I can use it. Yes, it is only < 0.5% market share but when your market is consumers, losing 1 out of every 200 sales is a big deal if it can be avoided for a reasonable cost.
Data Science Periodic Table
If we are looking at it like a business then your math makes sense. But as an individual, it would be cheaper just to buy a new iPhone because of the dead ends and time spent assembling the device. So yes if he did everything perfectly the first time then the cost was $300, not including labor or tools. But the actual cost is way above $1k including labor, tools, dead ends and research. A business can factor those costs as R&D as they will producing x amount of these but he is only going to produce 1 and who knows if those tools and parts will work on future projects.
OK, so are you suggesting that a vegan diet or otherwise avoiding animal proteins will somehow prevent and/or cure juvenile diabetes then...

I give up, and suggest you learn to Google something more than just source to try to confirm (poorly!) your own biases about what diabetes is or isn't.
https://news.ycombinator.com/item?id=14104404
Charles Murray wasn't discussing human biodiversity at all. His talk was on an entirely different topic. No one argued against him at all. They merely disrupted his talk and then assaulted him and others.

The Nazi in question did not engage in any violent acts at that gathering. That makes him a peaceful protester.
"Another dangerous decision is to use a lib for reusing code. This is particularly bad if the lib contains domain logic."

Question about this: if we're to take the above to heart, doesn't that imply that we may implement some common functionality multiple times? It seems there's a real tension here between "code re-use" as a generally laudable goal and the need to avoid sychronization of testing/deployments.

I'm curious how others out there have dealt with this particular issue.
CPU is never a real issue in my experience, even when using compression (lz4) on everything. I do run an 8-core machine, but it's only a Intel Avoton C2750 (ASRock C2750D4I is pretty cool motherboard board with 12 SATA ports built-in), but I do have 32Gb ECC RAM. 16 was probably enough, but I run other things on it in Docker (Plex media server etc). I installed a plain Ubuntu 16.04 with ZoL - and it has been rock-solid.
> Food we've grown + consumed has a multi-millennium history of being safe

The food we consume now has little resemblance past a visual one (and even not that in some cases), to food of the past.

Time-tested? Only in the past 60 years or so have we actually been able to begin to understand the effects of any food, natural or GMO. That our ancestors didn't keel over immediately after consuming these "same" foods does not mean they are anymore "safe to consume" than GMO foods.
I was going to post this exact same quote. It is in my clipboard.

Controversial note: When politicians talk about defunding the EPA, people get upset. When the EPA pulls stunts like this, it makes you question their purpose. Seriously, why have regulators that "tip off" the very companies that they are supposed to be regulating?
Yes, the Elm syntax is more Haskell than JS. Not C based, which makes it an outlier.

Please try Elm and email me with your feedback. Id love to know more about it. Im a programming languages nerd. :)
Pros and Cons of working remotely as a dev (audio)
Ray Kroc didn't found McDonalds, Richard and Maurice _McDonald_ did.

Also survivor bias but also you obviously will never accomplish anything without trying.

I think it is entertaining to try to find the abstraction that leads to success but it's probably more harmful than helpful to believe in something like that. Just do the best you can with what you have. Maybe it leads to success, maybe it doesn't but don't let that affect your perception of it, you did your best and that's all anyone can expect of you.
This was a fun read! When I got married the invitations were very important to my wife, but I built a website to handle RSVP (with my mother as a fallback phone#). It was a fun project, I had my wife help me design it and I also found the tally-at-a-glance helpful. I'm sorry you have to read all this bile about how you did your wedding, but I'm glad you had fun with it!
>I wonder where we will be in as little as 10, 20 years.

Can't you see the writing on the wall? In a javascript framework, hosted in javascript, all the way down, to some obscure operating system programmed by the ancients that it is best not to fiddle with.
Tim Berners-Lee Receives Obedience Award for Deference to Pro-DRM Corporations
Where did this come from? I didn't read that in the article, did I miss it?
You keep saying that, and it keeps being false. The point of U2F isn't to put your secrets in super-secure hardware so you can walk around feeling like you have an HSM hanging from your keychain like a bad-ass. The point of U2F is to defeat phishing attacks, which is how people actually get compromised.

It would not be much of a stretch to say that this U2F guide was written deliberately as a corrective to this mindset.
Let me know when I can take the train from Houston to Frankfurt.
Dealing with Real-Life, Everyday Security Threats
This is pretty close to my thoughts when I've tried it. One additionally thing is how good the object tracking is, placing virtual objects in the real world is very cool.
This was great and very entertaining. Thanks for sharing.
> The ideal solution is to fix all of the world's ills, but obviously that isn't realistic, at least not in our lifetimes. We can make progress, but help will arrive too late for many.

I love this sentence, and I want to say yes to both -- we should keep working to fix all the world's problems, and not be discouraged that it will indeed take longer than our lifetimes. And in the meantime show what kindness and mercy we can to people who are caught up in the undertow of today's social reality.
Well, tinfoil new spring collection aside, you can't really compare:

- the value of one average joe data;

- against the value of a well orchestrated PR campaign on a site that experts, investors and intellectuals use as an information hub.

If you are skilled enough to maintain a good reputation of a client on HN, this is quite a good thing to manage IMO.

And here I am, posting comments for upvotes while maybe I could pay for it. I should step up my game.
For reference, some previous discussion on GC here on HN: https://news.ycombinator.com/item?id=12821586
Am I the only one who thinks typed Javascript, wether it's TypeScript or Flow, is a really flakey experience?

I really enjoy Swift, so I'm not put off by types. But I find the experience of working in a real typed language to be very different to working with Flow or Typescript, where the types are for pretend, and type definitions are wrong often enough to be a real pain. And I found my self evaluating npm packages based on their type definitions, and not their suitability for the task, which seems bonkers to me.

Also, I don't ever recall staying late to track down a bug that types would have fixed. But I've wasted many an hour tracking down bugs caused by mutations, and the state of Immutability and Typed Javascript is pretty grim as far as I can tell, unless I'm missing something.
Containers Trends: The Growth of Microservices
The user doesn't care whether the text rendering of one app is consistent with the same app on a different platform, the user cares whether the rendering is consistent with the other apps he uses on the same platform.
Intellij has one in the works. You can download and run the betas now.

https://www.jetbrains.com/go/
No, companies that make billions of dollars in an ecosystem that benefits from said tools and don't pay a dime for the public good are to blame. It's not a problem with open source, it's a problem with a culture that takes and doesn't give back enough.
You can do it using the nginx-lua module, something like:

`local response = ngx.location.capture("/some/api/endpoint" )`

I would not recommend doing this, though. Nginx internals are rather complicated in my experience.
Post TypeScript 2.3 - per https://twitter.com/tomdale/status/851924328220381185
Ask HN: Open-source ad servers?
Are there any open-source ad servers that you would recommend? We'd prefer not writing our own ad server.
I wish SaaS companies (not just DatoCMS) would learn that developers will not adopt their products if they don't have source access.

This product could have easily been FOSS with it's pricing model based exclusively on support/hosting.

If you want early-adopters - be hacker-friendly, not money/data-hungry.
I can confirm that. Here's an example of how we take screenshots when automated tests fail, using Selenium + Chrome:

https://gist.github.com/masonmark/2332c1238a2fa70b5e4fcfffdc...
Seriously? I received maybe 3 cards of weeding and more thant 30 for my birdthay. I kept them all too. We can save tree when there's purpose like printing for reading an email, for invoice, etc. because they don't give or add any value, but my handmade card for my weeding, if you throw it is disrespectful, because If I had invite you, it's that I take care of you. (BTW I made only 15 invitations.)
- I never tried.

Try it. It's hard due to fragmentation.

- Chinese wife buys movie tickets online all the time, chooses seat if the theater has reserved seating.

Which app or site will let me buy a cinema ticket and choose a seat, on a mobile phone.
- credit cards in America put fraud burden on merchants. This is very different from china (ICBC grumble) and fraudsters in the states will target Chinese using credit cards in the states accordingly.

In theory, yes, it's on the merchant. In practice, it's a whole lot of hassle if your mag stripe card gets skimmed.

- online, on autopay.

Autopay isn't online. Unless you mean your computer or phone has to be on, or the autopay doesn't work.

- iPhone has had that feature for forever.

Doesn't work if even a single member of the group uses Android (or Windows or BB), which is pretty likely in a group of more than 4 people.
Yes, loops through time would be necessary to have ten years experience with a language that's five years old.

And FWIW: http://emilkirkegaard.dk/en/wp-content/uploads/Robert-A.-Hei...
I guess I didn't understnd that bit. It sounds like there is som mistunderstanding about how Yubico authenticator works?

It does not store the secrets on the disk/memory of the phone/laptop at all. It just sends over a code. The device only sees one code and nothing else.

This is also why a user can get a new phone and and just tap the key to the new phone and truck on. Magic.

When a user drops their Google Authenticator phone in the toilet however... bad day.
Most airports I frequent have water bottle fountains now that dispense cold, filtered water into your bottle for you. Just bring a reusable bottle or dump your water from a disposable bottle.
I'd be impressed if someone could give me a grab bag of real world use cases for the mass market. I'm just super not convinced that this isn't a Kinect sitting on your face.

And Lego/Minecraft on the tabletop.... no thanks I don't want games set in my lounge room, that's an incredibly boring place to set a game in.
Twitch streamers do this sometimes, and it's usually purposely choosing an annoying song.
And I can't wait for the rude awakening anti-JS developers have when they realise the vast majority of issues (particularly, performance) come from the DOM, not JavaScript. (And the first version of WebAssembly can't touch the DOM anyway)

If people start writing Python for the web for no other reason than they just dislike JavaScript we're going to be forcing users to download a dozen different runtimes, just because of developer preference. This isn't a good thing.
Where's your source that indicates organic pesticides are "low efficiency, high volume" Would love to read more about this as it may effect my purchasing decisions.

Also this: https://en.wikipedia.org/wiki/Glyphosate#Conyza

Which seemingly contradicts the "high efficiency" claim (at least moving forward)
Hacker Bootcamps VS. Universitiy: What to Choose?
Did you automate the Thank You's as well? That would be a time saver!
I'm curious as to why you don't like the use of classes. Are you against classes in all languages or just JavaScript?
No, denied boarding means they won't let you board in the first place. In this case, he already sit in his seat.
I was always under the impression that there is a ceiling unless you have the money to buy into the fund yourself. Is there any hope for someone who wants to get into the industry but can't afford to spend a few hundred thousand or million to buy in?
He didn't talk much about this, but I find it very hard to believe that they were able to make their own deposit application and get it certified for use (unless the UK has vastly different banking regulations than the US). 32-bit/64-bit systems have small rounding errors that are show-stoppers for banking from what I've heard. There is a reason why COBOL and Big Iron rain supreme in Finance.
>You fail to account for the possibility of unknown unknowns

This sounds reasonable. /s

Do you have an example of anything that accounts for the possibility of unknown unknowns? My guess is if you do, then all it will take to "debunk" it is someone with a bigger imagination.

EDIT: bad comma
Forcing passengers to relinquish seats they've already sat down in is clearly a terrible policy. Once you're in your seat you should be "locked in", except in exceptional circumstances. Pulling someone out of a seat has a much higher emotional (and PR) cost than denying someone boarding in the first place.
I don't think it would be. It'd have to have an upwards buoyant force of most of your body weight to really be effective. At that point we are talking about a huge balloon, meaning it'll cause a lot of air resistance which will cause problems when you're attempting to ride. You'll also lose a lot of traction. I think in the end it'd make it easier to be tipped over (especially if it catches a wind gust), and so would be self-defeating.
Here is tomorrow's Full-Scale JavaScript roundup issue for HN audience
Hey now, inferring that some journalists deserve protection because they may have credentials with a company or govt is both silly, and very dangerous. It creates a situation where you literally strip protection away from most journalists and put them in harms way.

Jake Appelbaum had a sendoff speech where he covered how his fellow journalists were putting him in grave danger when calling him an "Internet Activist" meanwhile he was publishing in the same paper as they were. He also covered how The Guardian left Julian Assange out to hang, allowed known compromised systems to remain in day to day use, and banned fellow journalists at other news orgs from writing about quite a few papers/topics from the Snowden archives.
I use Emacs and Linux and programming languages. The power of those artifacts as tools is that they were created to allow for possibilities that their designers did not imagine. The price is that these tools take years to learn and probably take lifetimes to master.

Their power comes from an early architectural decision to build an extensible platform and to allow users to build their own features upon the platform. Designing something to be a tool is different than designing something to be a product. Designing a product is pleasant because it assumes the conceit that the designer is smarter than the user.

Anyway, I'm not sure that is what you were asking, but that's what I wrote.

Good luck.
I have alexa and we use it CONSTANTLY as a timer for our kid. You have 2 minutes in timeout. Boom alexa does it. I can take him to timeout and get that started at the same time.

It also makes it so that I'm not saying when he gets out but a device is saying when he gets out. He doesn't tend to argue with Alexa but he will argue (negotiate) with me so it helps in that way.

I also use it to play music and read books to me. In the future I'm going to set it up to work with my smart home, but I haven't set that up because we're selling our house. Was it worth the price point? No, but now that I have it it's become part of my daily life.