skysight-inc/HackerNews huggingface dataset:
Ask HN: How do you manage your application configuration files?
Hi,
we are currently running a track where we are trying to change our delivery methodology from working with transformations in visual studio for configuration files to working with configuration templates with only tags, the configuration fields will be provided on the app start/init phase from an external service like "Consul" or "Etcd".

i wanted to know if you recommend anything ? or how do you manage application configuration files delivery on different environments ?

Thanks !!
I mean, run it by a lawyer if you're ever tempted to use this in a commercial fashion, but you'd generally get told by a lawyer "I've got an icky feeling about saying untrue things in a fashion which could possibly be described as touching interstate commerce, but there is a surprising amount of nuance in fiction and entertainment experiences."

Do I think SeeFood Technologies, Inc. is factually incorporated in a US state? No, I do not. I checked the four states it is most likely to be registered in (Delaware, California, Wyoming, and Nevada) and it isn't registered in any of them. Corporate registrations are a public record and trivially searchable; if I had access to Lexis-Nexis or similar I could probably run the search nationwide roughly as easily.

A sibling reply suggests that getting a Fictitious Name / DBA issued might be sufficient, but this would depend on the state/county/etc; some of them prevent folks from registering fictitious names with things which suggest actual corporations (like Inc.) or various things which the state wants to protect ("Bank", "Trust", "University", etc are common).

(DBAs are available like candy and might make a lot of sense if you've got e.g. an LLC which operates a product whose name is not the LLC's name, if for no other reason than "You'll possibly need this to convince your bank to let you deposit checks made out to $PRODUCT_NAME into $COMPANY, LLC's bank account.")
it is also likely at the end of the training the employee is more valuable to the company than to the competitors (since they know the culture and technology), so in order to keep them from moving to a competitor they should pay more than a competitor would.
primarily, we learnt by example and experiment rather than by query. to start we sought out every bit of sample code we could find in magazines, books, or usenet posts. we downloaded, printed, and read full manuals. when code failed, we tweaked every possible parameter and tested to see what changed. in a way, TDD was the (very manual) norm because it was the only option.
"Please provide your ID" "Ok so here's what we found on you" reads content of ID
I've heard Amazon gives out bonuses with those conditions, so I'd guess it's enforceable.
> The US is nothing but a grievous lie

Please don't post political or ideological rants to HN, regardless of which flavor. It's not what this site is for and we eventually ban accounts that do it.
AAC was released in 1997, why they start to advocate AAC after MP3's patent is expired?

I thought they state "MP3 is dead" just because its patent is expired, while AAC isn't:

http://www.via-corp.com/us/en/licensing/aac/licensefees.html
True but to be fair they're still fresh findings. And oldest as well, so comparison to other findings is pretty low.
Sonar Barcelona 2017: Tickets, Lineup and More
Oh, it is, it just makes them a lot easier to use. The compiler does method restructuring magic behind the scenes to build the necessary state machines. Everything gets a lot easier to understand.
Linux distro's are starting doing it right now.

Not sure about Audacity, but I guess that will be the same.
MP3 isn't transparent. The pre-echo artifact is inherent and unavoidable no matter how high a bitrate you use.

And even if it were, that doesn't make it worthwhile. Gzip compresses plain text by a factor of 4 or 8 and is lossless in the absolute sense, but most of us don't keep our text files in .gz form.
There is only a screenshot of the US. The world map looks hidden in some url linked in the article. And when you try the link, it works only on flash. No thank you.
The mysterious “Cueva de los Tayos”–home to a ‘lost’ ancient METALLIC library
Can anyone shed some light on how exactly Osquery can be used to leverage checking, for example, of vulnerabilities? I wasn't able to gather information on how it exactly communicates with the rest of the infrastructure. Am I correct to understand that I can set up a single host that has Osquery installed and it can go out and automatically query a heterogeneous set of other hosts based on pre-existing configuration files, given that (I assume) some set of ports are open?
I rip all my files to flac, mostly because I don't know which lossy formats will be popular in 4 years.

Anyway, anecdote time:

I was actually part of a double blind test.

On a really really good setup with very little background noise I can tell that there is a difference at 320kbit (encoded using LAME) with about 65% reliablity for short pieces of music, which was the second best in the group.

I could not, however, say which sample was better.
Is ecommerce beating retailers in Asia? We studied 20 companies to find out
I couldn't read this on iOS as I kept being forcibly thrown into the App Store by some advert. If anyone else is having trouble, you can read the article here: https://archive.is/tPvTT
Totally agree about the encryption. I've set up databases to run on encrypted disks (LUKS or nowadays on AWS you can get encrypted EBS), but I feel like that is really just to tick the "encrypted at rest" compliance checkbox, because if the machine is turned on, anyone can read the data (subject to normal file permissions of course). As far as I can tell the only threat this is protecting against is someone physically pulling the drive and walking off with it.

Also this business of two layers of encryption: yep, anything encrypted can't be indexed or searched (basically). At best you can encrypt the query input too and compare for strict equality---sort of like hashing passwords. (Is that what he means?) I've never seen anyone hash email addresses though. And encrypting billing details . . . okay, I guess, although if the app has the decryption key, then what security are you really adding?
Bear in mind that the Falcon Heavy was supposed to fly 2-3 years ago. At this point I'm starting to wonder whether it ever will.
>I admit. I am an introvert and I have by and large welcomed with open arms every advance in technology that has allowed me to deal less with other people.<

I used to feel the same way, until I realized that as an introvert, I am especially reliant upon the regular stream of casual, serendipitous encounters that punctuate everyday life for social and emotional well-being. Because I do not seek out contact, these small bursts of socialization are important to balance my mood and keep me grounded. I first noticed this during long periods in a non-native-language environment, where I realized that landing a good joke with a cashier was better for my equilibrium than any social media success metric.
For some time now I've been working on a new project with the idea that you want to use a single testing tool that can give you comprehensive, coherent, and deep advice. It's early days and there's a lot to add still, but even now it's pretty good: https://www.hardenize.com

Hardenize starts with the domain name (WHOIS), then DNS/DNSSEC/CAA, then email configuration (SMTP/STARTTLS/DANE/SPF/DMARC), then your web application (TLS/COOKIES/HSTS/HPKP/CSP/various headers, etc).

Before Hardenize, I built SSL Labs.
Well, not the first listen. But after MP3s aren't supported anymore and you have to convert it to another lossy format you might start hearing the difference. The point of lossless formats are that you actually own an original. That you have a copy you should be able to convert to anything else no matter what the market trends.
well, for one example, have a look at http://www.slackware.com/changelog/current.php?cpu=x86_64 - specifically

+--------------------------+
Sat May 6 23:12:02 UTC 2017
a/glibc-solibs-2.25-x86_64-2.txz: Rebuilt.
ap/cdrdao-1.2.3-x86_64-3.txz: Rebuilt.
Recompiled to support libmp3lame.
ap/sox-14.4.2-x86_64-4.txz: Rebuilt.
Recompiled to support libmp3lame.
d/flex-2.6.4-x86_64-1.txz: Upgraded.
kde/k3b-2.0.3-x86_64-3.txz: Rebuilt.
Patched to build with ffmpeg3 and gcc7.
l/ffmpeg-3.3-x86_64-1.txz: Upgraded.
Recompiled to support libmp3lame.
l/glibc-2.25-x86_64-2.txz: Rebuilt.
Reverted a patch that causes IFUNC errors to be emitted.
l/glibc-i18n-2.25-x86_64-2.txz: Rebuilt.
l/glibc-profile-2.25-x86_64-2.txz: Rebuilt.
l/gst-plugins-base-1.12.0-x86_64-1.txz: Upgraded.
l/gst-plugins-good-1.12.0-x86_64-1.txz: Upgraded.
l/gst-plugins-libav-1.12.0-x86_64-1.txz: Upgraded.
l/gstreamer-1.12.0-x86_64-1.txz: Upgraded.
l/lame-3.99.5-x86_64-1.txz: Added.
xap/MPlayer-1.3_20170208-x86_64-4.txz: Rebuilt.
Recompiled to support libmp3lame.
xap/audacious-plugins-3.8.2-x86_64-3.txz: Rebuilt.
Recompiled to support libmp3lame.
Yes, it does. Also a C# programmer. I really like Rust. About as easy to use to transform, filter, group etc, but considerably faster.
Yeah but that's with respect to the focal point. The focal point could be a good ways up in the air.
Nothing definite in here, just theories needs more research. Just a shinny news title
Angular: Scalable User Interfaces Talk
See the future of German police mobility: https://en.wikipedia.org/wiki/RMMV_Survivor_R

Of course the police needs their own tank, because, you know, terrorists. Boo!
Honest answer: No. Not in any serious sense. How would you do that practically? I suspect that there are very few places around me where I could purchase any form of food, where the staff isn't "getting screwed over financially".
North Korea and Russia are always fingered as the source of any hacking/malware activity that hits the news, regardless of actual proof.

The entire Sony hack attribution to North Korea was already shady, at best.

Saying a nation-state actor hacked you makes it look a lot less worse than "some disgruntled ex-employee" or a 20-something year old student.

I'm not saying this attribution is incorrect, but it's very hard to separate the wheat from the chaff with these kind of news articles, even from sources I'd normally consider reputable.
I do the same with Gmail, just add + at the end (As in username+docusign@gmail.com). Of course this has the drawback of some sites being to restrictive with their checks for valid emails and not allowing the + character
> The cave is named after the Denisovan people — a mysterious species of hominins from the Homo genus

Nope. The Denisovan people are named after the cave and the cave is named after a hermit Denis who lived there in the 18th century.
Better link : https://phys.org/news/2017-04-scientists-evidence-habitable-...

By the way, it's already a month old, there's nothing new since Cassini's last trip.

Also, can't believe Newsweek did a mistake like that if not for clicks...

"Update: An earlier headline read that signs of life were found on Enceladus. We regret any misunderstanding this headline may have caused. NASA has discovered that Enceladus is habitable, not inhabited."
Depends if you're using it with ORMs or not. It's equally as useful with data in memory. Definitely slower for some things though (yes, it's always slower in one sense... But its also easier to make parallel, so it can even out in the end)

Still, I now prefer doing such things in Rust.
I don't know what features exactly Everything has, but maybe fsearch is a good alternative?

http://www.fsearch.org/
But you can covert to whatever lossless format you need without worry. Lossless to lossless conversion is possible an infinite number of times (theoretically), vs lossy to lossy you get maybe a couple for free.
> but every package manager for every OS out there does things differently, Rust can not fix this.

Exactly, it can't fix it but it tries to cover over this fact by bundling dependencies with every app.

> I think what you want is every crate on crates.io to be packaged as an installable rlib and dylib for every package manager out there

Basically, but more to the point, when a bug or security issue is fixed I don't want to rely on individual programs updating their dependencies. Let's say 10 years from now the rust version of gstreamer is widely used and a security issue is discovered, I want to be able to "apt-get upgrade" and know that it's patched. This is how things work now with the c version, but this can't be done with cargo, every app using the library has to update it's dependencies and many (particularly any corporate ones) will never update. Rust might be a boon for security but cargo could undermine the effort.

Aside from that, static linking creates a tonne of bloat, memory and disk. There is a reason windows apps are often so bloated compared to their linux counterparts.

> The package managers can be configured to work with Rust, and likewise Cargo can be configured to work with the various package managers, but it takes work.

I don't think that's good enough, if rust wants to be a systems language then it has to work with the system, not be a layer on top of it like java/.net/node. It can do this technically, but culturally it's looking more like node and less like c.
Nothing within the current legal framework in most Western countries prohibits you from doing exactly that. Provided of course that such communally owned enterprises will still have to compete with "regular" for-profit companies.
Sandman-Lite Version 1.4.0 Released
The plaza and cathedral of Strasbourg (which you can see at the very beginning of one of the Sherlock Holmes movies starring R. Downey Jr.) has been engineered to channel wind around the cathedral, instilling a devilish, chilling feel and making the cathedral stand out as a safe haven.
People (some/many) believe what they read. Some CEOs in some corners of the planet will rush to their CIO and tell them "I don't know what this mp3 is but lets switch to aac A-S-A-P!!!". Then the poor CTO (if he/she has a technical background) will have to take 15mins to explain to the CEO that "mp3 is not dead, the patent is gone so not it's absolutely free, while for aac we'll have to be paying ABC amount for our XYZ product/service".

I guess the current aac patent holders are smiling now :)

Confuse & conquer!!!
No it's not, it's just the one that neural networks and amateurs on Kaggle are good at.
I can only comment about `getInitialProps()`. Of course it's should be on client-side as well, that's the whole point of universal rendering. In combination with isomorphic-fetch you can use your (Rest) API and have nothing to change on the code. I think it's an excellent design decision to makes components actually independent and easily composable.
Ah, but mobile devices are usually hidden behind a providers NAT and nearly all applications that are interactable and could be semi-directly contacted (eg. messaging apps) are written in a managed language, so a spread like we've seen with WCry is less likely to happen.

Having said that, have you seen the amount of malware hiding in advertisements for Android? There's a lot.
Wondershare TunesGo 9.4.0 Crack and Serial Key Full Version  [LATEST]
My mother studied archaeology and she told me once what she heard during her classes - that "religious significance" is the default label that is put on things they found when they have no clue what those things were for.
New MM SFP+s are $16 from fs.com, SM is about double (for 220m, 2km and 10km optics).

These days I honestly wouldn't recommend going with multimode for anything new. Use twinax for short distances (e.g. server to ToR) and SM for everything else. The price difference between SM and MM isn't really worth it, especially when taking in account the fact that MM cables usually need to be replaced on each generation.
Hmmm yes I have received a few and if I recall, some of them had titles very similar to docusign documents I was previously sent.

Exact titles similar to this: "Accounting Invoice 630761 Document Ready for Signature"
If the hacker gets access to the database due to a network config error, then they will be able to query the database, but only get records with some sensitive fields encrypted.

Given the number of email addresses that have been hacked and stolen (3.75 billion in Troy Hunt's haveibeenpwned alone), I believe doing one little extra bit of encryption on email addresses is worthwhile. We push that into our ORM layer and can easily flag any field in the database to be encrypted.

On very, very high volume accessed tables, you may not want to do that. But for user logon details -- for us it was a no brainer.
Microsoft Launches the Fluent Design System
Devops Online Training – Devops Online Course – Online IT Guru
Most of us don't have several hundred Gigabytes of textfiles though.
Indeed -- Osquery, and the commercial precursor Tanium and the native Microsoft equivalents, can help when you've identified one incident and want to find active repeats. Ex: "I just cleaned evil.exe from this box, are any other hosts running the same process? What other processes do they have in common?". I've seen hunting use cases as well.

Your example is why we're building our visual playbook system. In this case, query your network scanner for open ports, and then feed the identified hosts into more targeted osquery calls.
NSA probably shared a few libraries/ pretrained models with them, and forgot the waiver.
Additionally consumer boycotts tend to be directed at specific companies and serve a specific purpose, eg. trying to institute cross-industry agreements or get compensation paid to workers or their families after factory fires or collapses or whatever.
So there's this big hydrogen vent in a moon of Saturn. Where's the energy coming from to drive that? Too far from the sun. Enceladus is tidally locked to Saturn, so there are no tidal forces. Enceladus has very low orbital eccentricity, a near-circular orbit, so there are very low tidal forces from that. Some phenomenon must provide energy for the hydrogen jet.
Wait. So this just stores arbitrary byte blobs right. What exactly is the JSON bit about? Can I use jq syntax to query and transform whatever JSON is stored?
"Update: An earlier headline read that signs of life were found on Enceladus. We regret any misunderstanding this headline may have caused. NASA has discovered that Enceladus is habitable, not inhabited. "

Wow. Maybe basic transport is not the first area where intelligent machines will make their human counterpart superfluous. I'm sure machines can do better than this.
I've been doing this for awhile. It's especially interesting when giving it to a representative in person, some people will refuse to enter it in their systems. I've also had one webform reject it outright. Lately I've started just using random words to get around this awkwardness and make my pattern less predictable. When I get the first email from that company (often happens within minutes) I just give it the actual company's name as an alias in my client.
Theres always gazebo and a few others.
Car security experts dump all their research and vulnerabilities online
Security experts link WannaCry ransomware to Lazarus Group
> "math" is a name for the novel pieces of language ...

I'm keen for etymologies and hence believe that math means the art of problemsolving or learning successfully. That includes language as a problem domain, and teaching tool for learning, but as modern development would have it, it's about structure and organization, not just in language.
Co-founder for SME lending platform in India
Have $100,000 in financing. Looking for Co-Founder for Fintech SME lending venture based in Mumbai/Bengaluru. Send me an email at avi.dosco@gmail.com if you're interested and I'll forward you my business plan
Yes, he did. It was specific. I have a similar opinion.

Because the publisher also engages in climate change denial and other such thing, it is hard to trust anything in This book - even though it is a different subject. I couldn't read it and trust any factual bits presented to me - the worst case scenario is that I get these "facts" mixed up with things that are from more credible places without having the time or inclination to fact-check everything in the book.
Multi Step Registration an Addon Cedcommerce
Why? I shit on company property, during company time and use company resources doing it, is it their business if I scrunch or fold the toilet paper?

Assuming you agree they don't, things become a matter of where and why you draw the line.
For future reference, the show is Silicon Valley.
These are incredibly useful. I had never heard of bpython or mycli before, but I will definitely be using them.

This also gives me a lot to think about in terms of the UX for CLI applications that I write.
Sivers.org has got reviews and cliff notes for quite a lot of HN's favorite books, if you're interested. They're actually such good summaries of the books that a lot of the time I just read his synopsis and skip the book.
In order to get permission to build a large building in central London, it's necessary to have a distinctive, unique design. The city does not want to look like America.

Hence, the Gherkin, Cheesegrater, Can of Ham, Walkie Talkie, Shard, Helter-skelter.
While WinFS was a good start, I think the idea of a semantic file system could be extended much further to the whole system (if it weren't for pesky POSIX)

I think most people would expect

/home/geokon/program1/src/

and

/src/program1/home/geokon

to have pretty much the same content

A tag based file system that makes the two equivalent would eliminate all sorta of annoyances where you can't decide how to structure your file hierarchy
(should you have bin/program1 bin/program2 sr/program1 src/program2 or program1/src program1/bin program2/src program2/bin? both layouts have their advantages).

Something like a "path/path/bin/path/path/bin" wouldn't work.. but it's hard to find a case where you really need it. And the vast majority of time the subfolders aren't strict subsets of the parent (like mammals/dogs mammals/cats mammals/whales - where dogs/mammals would be a little weird)
Your data is in the clear within Cloudflare, and may even be in the clear between Cloudflare and the real host if you choose that option. You're trusting Cloudflare's security and Cloudflare's internal certificate authority. Hundreds or thousands of sites would be compromised if Cloudflare had a security breach. Like the one they had three months ago.[1]

[1] https://techcrunch.com/2017/02/23/major-cloudflare-bug-leake...
Really cool stuff! I didn't even realise you've switched jobs, but that explains why I didn't see you when we popped in at Townsend the other day! Keep up the good work.
They often ask me: do you work for <company> too?
Fake and real Product detection
The other disadvantage is that it's trivial to infer the true username from that pattern in an automated fashion.
I looked there. It doesn't explain anything beyond mentioning that the exploit involves heap manipulation.

The Metasploit eternalblue module simply runs an interpreter for a long set of commands that send massive binary blobs over the wire in a particular sequence. To me this looks like a cleaned up WireShark trace rather than anything based on true understanding of what it really does. As far as I can tell the only people who understand what these packets are doing to Windows are TAO and probably one or two developers at Microsoft.
or "you can't have that email address, that's our companies name."
Front-end Developer
Signing HTTP requests to AWS webservices elegantly
This is really nice.

Though, do you have experience with these exact modules? I have a bunch of “generic” or “cisco compatible” TXVRs died on me recently, some of them became rx-only, some completely unresponsive.

Still alive are finisar-made (or re-branded finisars) and avago. So I prefer used fini/avago to brand-new “compatible” parts.
great, thanks for your reply and looking forward to that blogpost!
"no good deed goes unpunished"