skysight-inc/HackerNews huggingface dataset:
> Note that you are trusting this app with your private key. While other apps are sandboxed away from having access, all it takes is one update to the app to sneak away your private key to any remote server. You have to trust the publisher of this app, including their entire chain of source code repository management and app build/release process. It takes a single instance of a malicious person inserting code that steals all users' private keys (disgruntled employee at this company, or social engineering attack to gain access to commit to their GitHub, etc.).

Fair point, not really applicable in this case though. It looks like everything you'll need you can find on their GitHub https://github.com/kryptco yourself.

Which means, you could check/skim the code strange "phoning-home calls" and get rid of them in your own fork. It would be nice to have some security experts doing some code review :)

> Also likely to be less devastating of a loss compared to the compromise of the contents of a password manager.

I often compare this situation like when you've lost your actual keys/keychain. The person who find your key's needs to figure out where to use them (if you don't store the address with your key's you're kind of fine)..
If someone find my private keys, github is something I would worry about the most. The good thing is you can add a passphrase to you ssh keys (something you can't do with your "real" / physical keys ;) )
"It’s like how MailChimp has become synonymous with sending email newsletters. If you want to work with data you use RDBMS and SQL. In fact, there usually needs to be a good reason not to use them. Just like there needs to be a good reason not to use MailChimp for sending emails, or Stripe for taking card payments."

Wow, that's a subtle, almost unnoticeable promotion of MailChinp. /s
Use a Google or Apple phone and stop worrying about their basebands, which are effectively USB peripherals.
Cruel seems right:

https://www.google.com/amp/s/amp.theguardian.com/us-news/201...
I thought that part was clear, that it was pedagogical example more than a useful one.

But to anyone who still doesn't get it and might be thinking the fact that Racket lacking such a feature is evidence that it's a less well-developed language than others, the reason Racket doesn't have string interpolation is because it's not really needed. If you're going to do large amounts of string templating, the "Racket Way" is to use Scribble: https://docs.racket-lang.org/scribble/index.html

Scribble is basically Literate Racket. And it's able to generate a very wide variety of document formats, far more than I've ever seen any documentation or string templating tool do.

There is also quasi-quoting and un-quoting, for doing a very similar thing with Symbols: https://docs.racket-lang.org/reference/quasiquote.html
The sheer number of open telnet ports on IoT devices is staggering and embarrassing to our industury as a whole.
I found the fork / refactor of VIM by NeoVIM to be very hostile and even naming itself "New Vim" made me not want to support NeoVIM. I have been using VIM since it was on my Amiga in the mid 90s.

VIM has been a stellar project that is due a lot of respect. Even the funding for VIM is reflected back to giving to Uganda children charity.

> NeoVim exists at all is because Bram Moolenaar refused to accept any patches for async support. People already did the work for him and he didn't want it.

Untrue: "It's going to be an awful lot of work, with the result that not all
systems will be supported, new bugs introduced and what's the gain
for the end user exactly?

Total refactoring is not a solution. It's much better to improve what
we have. Perhaps with some small refactorings specifically aimed at
making Vim work better for users." Brian Moolenaar https://groups.google.com/forum/m/#!topic/vim_dev/x0BF9Y0Uby...

NeoVIM kind of said that VIM was just a mess and it would be impossible to grown past where it is. To me this was worst then Ubuntu having it's own Unity and Mir. This was just drama and seemed over the top disrespectful to Brian.
Maybe so, but not in the same amount of time. Sequoia and Kleiner have been around since 1972. 45 years. YC has been around since 2005. The larger a startup gets, the more likely we are to hear of its failure, and the firms you mention are all making much bigger bets. YC comes in earlier and spreads its bets wider. It takes it more than 100 startups per batch. I doubt Sequoia makes 100 investments in a year.
Sure, but you won't need to NAT them.
Test Results for AMD Ryzen
Lots of commentary here, including "why not just stay in the browser"? Certainly you can run Slack in a browser tab, but I don't think they'd be enjoying the same success as they have now without having the presence of a full app.

So I'd spin the question around: why NOT offer a desktop app option—considering that electron makes it a pretty light investment for any team already building a web application?

If you already need your product to work in the browser, you're a small-ish team, and your feature set is in motion, I think it's a good strategy to do an electron app because it further incorporates your product into the day-to-day experience of your users. There will certainly be a point where offering a native desktop app becomes worth the investment, but that may not be day zero.

Meanwhile, would love to see google work more closely with the electron project to help (1) use the chrome runtime if it's already present and (2) at least allow two electron apps to share a runtime footprint.
When I did use Slack to communicate with remote coworkers. I just kept a tab open - with notifications turned on. Most of the time I was working with three monitors anyway.

Now that I only use Slack to communicate with former coworkers I just keep it on my phone.
> Such as?

SQLite and Postgres are the main examples I think of for this.

> The AOSP, BSD and LLVM ones surely aren't such projects.

AOSP is almost entirely ongoing contribution by the primary commercial user, so it would probably fit the description, though I was thinking of—without having stated—specifically third-party commercial users, so it wasn't what I had in mind.

> clang is being adopted by embedded vendors that had to contribute their changes back to GCC and now don't need to keep doing it.

Clang has a lot of corporate contributors, including all of the big three tech companies. Not sure if any of the big contributors have closed downstream derivatives or if they are just open-source users contributing back. Sure, copyleft prevents downstream use that doesn't contribute back, but it doesn't necessarily maximize contributions back.
This fact alone, after several years of changing schema and migrations, led to us having major rewrites and porting over to much more hands off approach. It's an understatement how much AR has led to just confusion especially with new employees!
Show me your well-defined normalized tables, and I will know the rules for a valid state of the system. How, though, will I know the rules for a valid transition from one state to another? Have I seen some nasty stored procedures? Yes, a number of which I have written. But I have seen well thought out and useful ones also.
That describes me. I think it would be good if SQL databases had more accessible tools. The experience is just totally different from other programming languages. When I see a complex query I can't read it and don't understand what its implications could be. It reminds me a litte of regular expressions. If you don't use them all the time you forget the syntax and have to look it up every time you need them.

Either a more modern looking language or some easy tools to analyze and build queries would help a lot in my view. Also refactoring tools that can analyze the impact of table changes in all stored procedures would be nice.
Carousell | Backend Software Engineer | Singapore | Full-time

Carousell (http://carousell.com/app) is a mobile classifieds app that makes selling as easy as taking a photo, buying as simple as chatting. With over 57 million listings, we are one of the world’s largest and fastest growing marketplaces. Carousell began in Singapore and has spread to 19 cities around the world. Carousell has also been ranked as the top Lifestyle and Shopping app in Singapore, Taiwan, and Hong Kong and was awarded Google Play Best Local App 2016 in Singapore.

Carousell is looking for a Backend Software Engineer to work on building the simplest buying and selling experience on our mobile application. Your responsibilities would be to:
-Design and build scalable REST APIs for the Carousell marketplace platform.
-Work with the Android, iOS, web, product and design teams to build innovative, robust, and easy-to-use features for our users.
-Work with infrastructure team on performance profiling and optimisation.
-Write clean, testable code with unit tests.
-Participate in code reviews to maintain a high-quality code culture.

Requirements:
-Degree in Computer Science, Software Engineering or other equivalent degrees/experience
-5+ years experience in software development
-Deep experience in Python, Django/Flask, RESTful APIs
-Excellent knowledge of RDBMS and object caches such as PostgreSQL, Memcached, Redis and knowledge of how to design, tune and optimise SQL queries and caching strategies
-Experience in building large, scalable distributed systems with good understanding of microservices architecture and associated principles
-Experience with TDD/BDD and agile methodologies

Good to have:
-Experience using Elasticsearch
-Experience using RabbitMQ, Kafka and microservices-based architecture
-Knowledge and experience in building distributed, asynchronous task systems

Apply now at http://grnh.se/ou4qd81

Contact: sakshi.malani@thecarousell.com
IoT Security Anti-Patterns
I didn't bother reading the Android list. If you're concerned about Android security, as I am, don't use Android phones.

Your iPhone list has virtually nothing to do with the difference in security between phones and computers. It's just a bunch of things you don't like about phones. What on earth does A5/1 have to do with any of these issues? Cracking A5/1 keys doesn't break your IP sessions.
>The second annoyance I have is the push for schemaless. Schemaless does not exist. There is always a schema, except in a schemaless data store, the schema has been moved to app code and then my earlier comment applies.

This is a great point. It's like types for programming languages. They always exist; it's just a matter of whether you have the compiler managing it or whether you need to keep it in your head when you're hacking.

> I think the lack of understanding of SQL and bad ORM experiences (Hibernate WTF) is what led people to think SQL/RDMBs were the problem when in fact they were not.

Again, like types in programming languages, I think the ability to iterate quickly without having to predict how the data will be used in the future leads to 'schemaless' approaches which can be kicked out the door more quickly (maybe) than ponderous schema laden tables.
Why the gains from e-commerce are spreading across the country
Thanks for the tip, hadn't heard about it before but any SQL feature that inspires articles like "Using the SQL MODEL Clause to Generate Financial Statements" [0] is generally the mix of practicality and code that I'm looking for. I suppose one major roadblock is the use of Oracle SQL. Not the language but the database software. I used to teach MySQL and SQLite before settling on solely the latter. First, SQLite can easily handle any database that students have to deal with, which at max are in the gigabyte range (and usually much much smaller than that). Second, there's far fewer moving parts. I mean, they still have to deal with the idea that SQLite is a database, and that something like DB Browser for SQLite [1] is a client, but it's much less of an obtrusive detail than installing MySQL, a MySQL GUI, and then checking to see if the MySQL daemon is running on their personal laptops.

[0] http://www.orafaq.com/node/69

[1] http://sqlitebrowser.org/
Get Straight to MVP Using Chatbots (and Algolia) (Part 2)
From the article, it sounds like looking for a judge's or court clerk's signature should suffice. If they forge that, they've crossed a line that's not ambiguous. If it doesn't have that, it isn't a subpoena.
In a sense, and there's no shame in that. Index funds recognize that retail investors are bad at choosing where to place their money. I think it's equally plausible that venture investors are just as bad, and that spreading your bets within a certain range (in stocks, publicly traded companies) reduces risk and increases the likelihood of gain.
>I don't know about the PC Pentium chip, but on laptop Celerons and Pentiums Intel must have like 100%-150% margin.

A margin of 100% would mean a cost of $0 (it's all profit), and 150% is not possible. See definitions here - https://www.business-case-analysis.com/margin.html

Perhaps you meant something like "markup".

As for margin, if the company is selling for $100 what they are making for $30, that is a 70% margin -- as your parent comment had stated.
Right, IPv6 gives you no guarantee that you'll be reachable. What default firewalling should look like is still an ongoing discussion.
What do you mean by more than 100% margin?

If you sell something for 150$ and it cost you 30$ your gross margin is (150-30)/150=80%.
> explosive growth from cloud providers is starting to level off

Got a source for that? I work in the industry and I'm not seeing this at all.
Deep-learning AI on Raspberry PI: build your own smart speaker with Snips
I came expecting a treatment on Structured Query Language, was disappointed when it turned out to be on Relational Database Management Systems. It doesn't take a rocket scientist to figure out why RDBMSes won out over non-relational systems.

What I want to know is why nobody ever came up with a better query interface. Every abstraction I've ever seen was built on top of SQL.
Strasboug (DE) - not for quite some time.
Is it possible to use a chip/EMV credit card as an X.509 certificate? Let the credit card company know your private key (paranoid assumption; not necessarily true) & skip straight to step 3!
I find it quite useful! My username should explain why :)
Yes! That is what I need, right there.
Using tools such as sqlmagic or pyodbc for ipython (below) you can let the sql database perform most of the heavy lifting of getting "raw" result sets into a dataframe and then perform some lighter, possibly more ptyhon-idiomatic tweaks to the data once the focused set is loaded in-memory.

def getdataframe(sql):
try:
connection = pyodbc.connect("DSN=myDSN", autocommit=True)
return pandas.read_sql(sql, connection)
except Exception as e:
print repr(e)
finally:
connection.close()
All of this said, Slack, I feel you've proven your model out, so it may be time for you to go native with your product. Do it as part of your commitment to the environment—you could prevent the emissions required to power so, so many spinning fans.
Sonovate | Full Stack Software Engineer | Cardiff, UK | ONSITE | Full-time

Sonovate is the fastest growing Fintech organisation that is taking the recruitment sector by storm. Our package of finance and cloud based technology has allowed us to rise to the top and we have a few awards to our bow too. We’re nothing short of ambitious, and we’re seeking dynamic, like-minded individuals to join us on our journey.

We are looking for a Software Engineer to be part of our Cardiff office. You will join a team of folk who are talented, ambitious and forward thinking. You will play a huge part in Sonovate’s success story by helping to design, develop and test high-quality and innovative web based software solutions.

More here: http://www.sonovate.com/careers
There have to be some checks, somewhere. Even though it's limited to one module, you can get temporal inconsistencies.

e.g. you add a new field and an application level default, then later that default is changed. Now there's no notion of which default the docs that never had the property should be using. Sure, you just need to patch the old docs to set the property where it's missing. But the GPs point was that by not keeping a consistent schema you end up moving the definition of the data into the application, and you need to be very aware of the trade-off.

Personally I'm really happy using postgres and dropping into jsonb when it's the correct model to use. It's the best of both worlds as far as I'm concerned. I've built and worked on systems using nosql solutions that have been migrated back to sql and the data inconsistencies we found have made me very wary of having a primary datastore that doesn't enforce strict constraints.

Though, everybody's use case is different.
> So are actual computers

Sure, but no one was making claims about actual computers other than the human brain that requires pointing that out.

> but nobody would really claim a Commodore 64 is not Turing complete.

Actually, it's a rather common observation that real-world computers are not Turing complete (languages, considered independent of the limitations of concrete machines, may be) and particularly that concrete machines with limited storage space and operating with finite time constraints may not be able to compute all computable results, even though the abstract model they approximate, without those limitations, can.
Great solution! Thanks for sharing.

Your last example is especially interesting, as it shows the problem with the reader extensions I forgot to mention in the post: the introduced identifiers have local scope. In other words, both redefining `string-append` and not having it in local scope when calling it are problems.

In your solution the `#'format` expression binds the `format` function to whatever is called `format` in the current module (but in the next phase, which is why you require `#%datum` normally and not `for-syntax`).

I regret not putting the hygiene considerations into the post, I planned it but, honestly, forgot about it :( I'll add it to the post, along with your solution (is that alright?)
The subtext may not be in Jessica's piece, but YC's strategy implies that only a few of their investments need to go big for them to win. While certain aspects of YC do standardize startup growth, a lot of parts of the process can't be standardized. What you have left is a numbers game. If all YC startups succeeded, that would be a sign of failure, because it would indicate that YC itself was not taking sufficient risk.
Considering there are companies such as GitHub and Microsoft (VSCode) behind Electron, I'm thinking they will eventually fix the memory/CPU footprint problem.

In terms of programming and development I think it's great. Not to mention that with JS there's tons of languages one can choose from -- think of Elm, PureScript, TypeScript etc.
I thought linode and digitalocean were clouds not VPS
keep getting "There was an error completing your request"
I recently built a system with R7 1800X and Arch is randomly resetting when running its 4.10.* kernels. Fedora, with 4.11 rc builds (the real thing is out now btw) has been rock solid with weeks of uptime, running games & browsers & development stuff.
Guessing pages visited via TLS using traffic dumps
Unfortunately it is the same in most of other part of the world, it is dangerous to assume that police is your friend.
Docker names Steve Singh as new CEO
Ask HN: Feedback on my single founder startup – Breach Canary
Landing Page: https://breachcanary.com

Would love some feedback on my overall startup idea, but also my landing page - I keep flip-flopping between the idea of it not being detailed and technical enough (talk more about features), or if I should leave it high-level for now?

The idea is a little like a reverse-'Have I Been Pwned', or maybe a database watermark.

My startup will produce a unique canary to add to your userbase, which if any of the following occur, you will be alerted in real-time:
- Canary receives an email (they get a working email!)
- Canary receives a phone call or SMS (they get a working phone number!)
- Any details of the canary are found online. We continuously scan the internet, and the dark web, including hot spots like Pastebin.

Should this level of detail be on the landing page? Including details of all the additional features?

Any feedback appreciated!
That's fine if you want to overclock. I need performance for work and I'm not going to dick around with overclocking - one work day lost to overclocking or an error caused by overclocking means that it's less value that just buying top-of-the-line from the beginning.
Yes, I read them back as a JS object in whole on login. A few things are mandatory (hp, position) but most are optional and are only checked where needed.

if (player.hasSomeProp) {
doStuff(player);
}

With your suggestion I would have a table with 200 fields and would probably have to add a lot of related tables since some of the props are arrays, objects etc. I also would lose the ability to just load the player as is (player = documentFromDB).

With "no-brainer" I mean it doesn't take any effort when developing since the representation of the player object in runtime is exactly the same as it's stored in the database.
If you consider ElasticSearch a NoSQL solution, then yes, many stories. A properly normalized database can be very slow to search, and throwing ElasticSearch in front of it is a very common solution.
Not the op nor on their project but I do work at a company using Haskell to solve interesting theoretical problems and for mundane software like cli tools and grpc services and web services.

Most people have an assumption that production Haskell involves a lot of theory when that's actually more the exception I think. My day to day use of Haskell (with the exception of a few projects) is as a strongly typed imperative language. In order to use it in production in that capacity you should have an intermediate level understanding of the type system so that you can wire library apis up and use them.

The productivity gains from Haskell's type system are quite large and they compound, particularly when you have multiple people massaging the​ code base.
Related blog post from Docker: https://blog.docker.com/2017/05/introducing-docker-new-ceo/
In my opinion, there is not a better book on Wolfram's ideas than Wolfram's. The text is very readable. The illustrations are sharp and clear. The coverage of the topic is comprehensive. Wolfram's book reflects many years of hard work writing.
Please, please, please always mention basic security as well!
I recently got a free server off craigslist to learn more about server hardware. Turns out the Server contains ALL company data from a small law office.

- pictures of the office opening party

- clients addresses

- employee contracts + data

- written warnings to employees

- ALL communication to/from clients

- INCLUDING stuff like stalking Protective Orders

Additionally, one CEO saved data from his other company on the server. His company dealt with medical stuff. The company was eventually sold for an undisclosed amount of money - but the server also contains correspondence to investors and board of directors....

The data is almost 10 years old, but some employees are still in business. Please always teach basic security when talking to anyone who handles 3rd party data. Lawyers must be aware of the value of their data. No victim of stalking wants to have their case correspondence public.

Instead of learning more about server hardware, I'll probably use this data to learn more about data/document analysis and use it as a simple example when talking about the boring topic of computer/data security.
I've had one instance of network downtime lasting 40 minutes in December which was SLA refunded. No incidents since then.