skysight-inc/HackerNews huggingface dataset:
OWASP has published a release candidate of the OWASP "top-ten" available as a PDF at https://github.com/OWASP/Top10/raw/master/2017/OWASP%20Top%2.... They also support the creation and maintenance of quite a few OSS tools to help secure systems.

To those who are claiming some of these steps are too onerous or would cause performance issues: Are you sure? For an individual system, maybe some of these checkboxes are indeed overkill. Or perhaps your system isn't as secure as you believe? To be fair, there are systems that don't require as much security because the data simply doesn't matter - if they systems contain email address / password hash combinations, they should still treated very carefully.

I think the biggest mistake I've seen made time and time again is that teams go the cheap route and put the database on an Internet connected machine. Don't build a whole architecture until you've got customers to support it but don't be quite that cheap at the beginning.

For systems that require higher than average security, I've been part of a team that went to MUCH further extremes.
Using security features to do bad things
> With timeEnd I get the number I want but would like to see a "safe" approved way of where to place the timeend while dealing with async/promises/recursion separately and together.

Measuring asynchronous code? You are not measuring your code. Your code is only the synchronous parts, the time spent in asynchronous parts are "environmental factors". Your code doesn't run during those times, it sits in the event loop waiting for an event so that it can continue.
I probably restart it every couple of weeks, and I switch it off at the movies, because the alarm can turn sound back on.

When I was on-call, and then got a weekend off, I turned it off. Someone always tried to call. But I'm not in that 24/6 space anymore.
How to use Facebook as identity provider for back end of mobile app?
What is a "visual playbook and pivoting system"?
> Opus is supported in all major webbrowsers and natively in modern Android systems. I'd call that widely supported.

http://caniuse.com/#feat=opus

Not supported in Safari. I guess the reason is that iOS devices don't have hardware encoder for it and Apple doesn't want to compromise battery life (maybe marginal issue with audio, but big issue with webm).
Why can't we strap two F9s to a Space Shuttle and recover them?
The problem with automation nowadays is not that it takes away jobs. The problem is that society is not allowing automation to take away more jobs. Number of "jobs" shouldn't be the metric to measure success.
There's some good Android & iOS security checklists here - https://codifiedsecurity.com/2017/04/24/mobile-app-security-... & https://codifiedsecurity.com/2017/04/19/mobile-app-security-...
Show HN: Doctest 1.2 – features and huge improvements in runtime performance
It is artificial users when their data is used it means your privacy has been breached. In a way a canary is not just a sacrifice but a transparent sacrifice.
Sounds like a job for "learn enough to be dangerous" https://www.learnenough.com
==& ?

I use .equals far more than ==.
Swedish Startup Is Working to Translate the Language of Dolphins by 2021
HN needs to adopt a [clickbait] tag to flag articles like this with misleading titles.
That's a great example of a double standard. Unlike sex there are obvious negative health effects and DoS for non-participants, yet the most I've seen a company do is put up a passive aggressive poster or send a strongly worded email from HR. Without the threat of sexual harassment lawsuits they trust us to be self policing adults.
Gorgeous design! Nice to see some cheery bright colors for a change.
To do something similar as an individual, I highly recommend 33mail.com [1], which provides a generous free tier, and lets you supply arbitrary <companyname@yourdomain.33mail.com>. As well as knowing where a leak originated, you can easily block any inbound email address if it is being abused.

Not affiliated, just a happy long-time paying customer.

[1] http://33mail.com/rj37w3
IMGs (Citizens) and FMGs (foreign nationals who went) are considered slightly differently.

IMGs have the advantage of speaking English and have no potential visa issues.

This distinction will matter more and more as the race for residency spots tightens and the US becomes more insular, because a lot of IMGs have US educational debt. It also matters where the person went to medical school, e.g. US citizen who went to Israeli medical school vs someone who went to the Caribbean vs an Indian national vs an Iranian national who now will have visa issues with trump. Visa issues are huge, because no one wants to match someone who can't show up for work 2 months later.

These subtle distinctions are not easily sussed out by NRMP data, but the trend is that in the current era, IMGs have a slight advantage.
SQL Server Clustered and NonClustered Indexes Explained
LIMITED TIME ONLY, Life Begins After Coffee T-Shirt
Given the ratio of spam to ham, as a general rule every email is probably bogus.
Hackers claim to have stolen Pirates of the Caribbean 5 and demand ransom
Please stop waving your hands. I prefer the deBroglie-Bohm interpretation where you have both a particle and a wave. Changing the shape of the wave by changing site B setup changes where the particle ends up, even if the particle does not leave site A. (However, for this experiment to work, there should be a chance for the particle to travel from A to B, otherwise the pilot wave won't travel either)
Always set to silent. Never turn it off but I tend to not even take it with me most of the time. Important stuff never happens via mobile phone or social media anyway.
Apps used by a young Chinese investor
Windows Subsystem for Linux – Update
Why you should totally switch to Kotlin (from Java)
Solved MCQ Questions on Computer Networking Set-1 – InfoTechSite
Beads made from meteorite reveal prehistoric culture's reach
Do they really sell through all their stock?
One of the prime arguments in support of a livable minimum wage, is that is also increases purchasing power of people, increasing the revenue. More people could have bought books and made up for the difference in wages they had to pay.

They obviously wouldn't have ever seen that happen, had they shut down immediately before giving it a chance. And I have to assume that higher purchasing power in the book budget of people has been used up by the 300+ 100$ sponsorships a year.
WW3 CHRISTIANS SUFFERING AROUND WORLD while mrs may supports muslims
...and you get a little taste of this when you use the supermarket self checkout. Accidentally scan an item twice and need to cancel one? Approval needed. Scan unknown barcode? Approval needed. Press the wrong button when trying to use a gift card? Approval needed.
Even better, HN should hide the real title until hover to reduce the number of clicks clickbait articles get.
Is she a member of the AMA?
In time for the Linux Audio Conference in Saint-Etienne, which starts this Thursday. (http://musinf.univ-st-etienne.fr/lac2017GB.html)
So Cloudflare is handing over the complainants personal information to the person being complaining about? wtf?

Then the CEO defends Cloudflare by saying "There is no imminent danger it creates, and no provider has an affirmative obligation to monitor and make determinations about the theoretically harmful nature of speech a site may contain."

Seems like an argument against handing over the personal information to me. There must be some information missing here.
The did the classic lazy news thing of publishing a press release and with a new title. Nothing more than low value news filler.
The plumber example is a good one. All the AI breakthroughs you read about seem to have simple "IO" so to speak. Even a self driving car while a challenging task, is reasonably well constrained, an effective solution might be possible with just cameras, throttle, brake and steer angle.

A robot I can call about a plumbing problem, that can realize it needs to dig up a pipe in the front lawn, successfully dig up the pipe in the front lawn and fix a leak. Not to mention the rest of the things a plumber does. Now that is hard task and I can't see it being solved any time soon.

Any job that has difficult "IO" is a long way from automation in my mind.
So your solution to fixing a basic ops problem 'software package A was exposed to the internet with(out|effectively no) auth' is: encrypt shit in an ORM layer and destroy your ability to do anything beyond absolute string comparison queries.

No thanks.
Cardigan's fault wasn't initiative, but ego. And the orders were anything but simple and clear.
Did you mean "And relax" in your how it works steps?
I really look forward to seeing HN's take, and typical HN-like, in-depth discussions of some of these topics. HN users have an impressive breadth, depth, and diversity, and are insightful and generally courteous and respectful, and as much as you seem to eschew and squelch these topics, HN is really where they seem to get their best treatment. While I generally appreciate your beneficial policing and moderation, I think it's at it's best when it's promoting high caliber discussions, rather than the censoring. I understand moving "off-topic" posts off the first page at an accelerated rate, but maybe you could give them a few hours more daylight before burying them? All this notwithstanding, thanks for all you do.
Buying and selling Bitcoins on btc-e.com. I thought about automating trollbox trolling too.
Do tech startup techniques work with a food business?
And many modern languages don't have semi-colons. Wonder if they can be removed from C#?
Although to be fair human interactions in DOTA2 in the 2K tier is definitely something I would aim to eliminate. Impossible to have a game without at least one player being rude. It's not as bad as LOL, but still the community is in a sad state. It's shame given that the game requires you to communicate by design.
Prepared statements are amazing. Found out about them very soon after I started programming (incidentally my first language was PHP), and switched to PDO right away. This was years ago, I don't understand how people are still using the deprecated and insecure mysql_* functions, you can still find them all over SO and my university "web" class was teaching them as well...
I'm sure someone on HN is seeing this right now and has already started working on it :). Especially with the advent of Google Assistant SDK and the likes, it's clearly very much possible now.
D and Python use the "is" operator to compare reference identity. It is the lesser used operator and the more advanced concept, so using == for reference comparison is just a newbie trap, doubly so since you have to use == to compare equality for primitives.
Och yes, I am quite looking forward to watching the carriers sail past, even if I am a bit dubious about their utility.

Must have been quite a site to have the Forth full of ships though.
| grep ... | sed ... | uniq ... | etc ...
I do! Well spotted, I'll fix that one shortly

Edit: fixed :)
A clean, responsive 7 Minute Workout web app
Maybe we have a shortage of GPs because specialists, such as plastic surgeons, earn lots more money.
Well they are not famous for their news articles but their technical reviews. If you are looking for a laptop or a phone, then gizmodo and engadgets are really good sources. My guess is that they had to expend (investors probably asked for it), so they did news (badly). But their core skill is still very good.
Sounds like a bug in iOS...
Vinyl FTW
I get that right that as a probabilistic data structure, the answer to `lookup(element)` to a prior inserted element might be false? How much faster is this implementation compared to alternatives? What's the use case?
No, we don't encrypt indiscriminately. We selectively pick fields to encrypt - fields that are highly sensitive.

And you are right, we do this because an ops error can easily make a mistake sometime in the future and probably will one day. We all make mistakes and defense in depth is all about that.
I never visited the site, so I didn't have to agree to any ToS, but I heard http://internetatlas.org/ contains interesting content.
Are You REALLY a Thought-Leader? Probably Not
I don't know what the HN policy on referral links is, but here's a link without affiliate tracking:

http://33mail.com
I merely stated that were sex in the workplace to be considered inevitable, and it probably should be, that it would be preferable not to just let it be had anywhere. I never insisted that any company be required to do anything.

Also, it's weird that of all the things you could have compared sex to, you picked "being an asshole" and, apparently, racism.

You know sex is a good thing, right?
Holographic Cortana appliance
Uber for dating is here
Benefits and Some Facts about Healthcare Apps
Of course they're different activities, but I haven't seen anyone give an objective reason why one is good and one is bad.
I think he means the extra quotes that was causing syntax error.
Wouldn't that clause be voided too?
Thanks for the amazing response and advice given (I realize I'm a beginner still in A) and B), and perhaps C) to some extent :)).

I do have a passion for fine dining but I'm not sure if I would be able to handle the pressures of working in a professional kitchen. I do think it would be a more rewarding profession compared to programming in a corporate environment which has become a chore.

I think I may go with your advice of developing my skills as a hobby!

I should have phrased my last question better- I was wondering if as an Executive Chef and technology enthusiast you can think of ways a mobile app (or technology in general) could aid a team of chefs in a professional kitchen? (developing something like that would be a pretty amazing experience).
Oh please. It may be useless out of the box at detecting evil USB devices, but to accuse it of being outright useless is ridiculous.

I'm sure it was sarcastic snark, but of course they have heard of udev: https://github.com/facebook/osquery/search?q=udev.
Is Microsoft to blame for the largest ransomware attacks in internet history?
Disney will certainly be quite happy to have this much free advertising for a movie that is going to start being shown in cinemas in a few days.

It's hilarious to claim that the leak of Expendables 3 was the reason it flopped on the big screen. But of course, if I were responsible for the movie, I would clutch at any straw possible.
I second this, world wide release would be nice. It's a shame how many "locale neutral" apps end up walled in on the US app store.

Is there any specific reason why this happens, just seems to me like you get worse reach and no benefits? Especially for a marketing stunt like this.
The key piece of info from the ProPublica article is:

> For instance, when a reader figures out that Cloudflare is the internet company serving sites like The Daily Stormer, they sometimes write to the company to protest. Cloudflare, per its policy, then relays the name and email address of the person complaining to the hate site, often to the surprise and regret of those complaining.

I think this could have been better written (you can tell it's biased due to it stating, "relays the name... to the hate site" [emphasis mine]) and it is company policy to relay this kind of information to the owner of a website, regardless of content. The title and sensationalist writing is unnecessary; it's not like their policy is to secretly send this information to hate sites only, it is to send to any website that gets a report.

Essentially the issue that was happening before was that users could submit abuse reports, but these reports couldn't be truly anonymous and the reports were also sent to the website owner. As stated in their blog post from last week [1], they've changed the way it works and now allow truly anonymous reports. One thing to note is that the original abuse form did let users submit fake information because it wasn't verified, but it seems a lot of people didn't pay attention to the disclaimer and gave their real contact info. Additionally, the reasons they forwarded the information to the website is detailed in the blog post. The blog post is a good opposite to the ProPublica article.

Also, side question: What is The Root? Is this Gawker for extremely liberal readers, kind of like a shitty, overly sensational Vox?

1: https://blog.cloudflare.com/anonymity-and-abuse-reports/
But this is like deciding apples have too much sugar and buying cake instead.
This seems like a natural if pathological outgrowth of tech culture obsessed with newness. When a 3 year old phone is described as ancient, obsolete, or out of support for two years, how good could a 2 decade old compression system be?
> The answer it seems is to speed up the voice tenfold!

That seems very common for systematic text-to-speech users, I saw a video a few months back of a lawyer (?) demonstrating ios's accessibility (rotor, voiceover, blind curtain, …) and the TTS speech was so fast it sounded like white noise to me.
"A very old password (say 1 year) has a higher chance of being subverted purely because there is more elapsed time wherein attackers could have gained access."

Any actual evidence for this? My counter-hypothesis is if your password lasts 6 months of attempted hacks it'll last >6 years (unless social engineering attempts succeed).

I ask because rotating goes against the current NIST password guidance. In fact, for your recommendation "Implement simple but adequate password rules that encourage users to have long, random passwords", I'd recommend pointing people in that direction.
Does it?

The article distinguishes human interaction per se from the mediated, channeled experience provided by Facebook, and by trivial extension other social media. This is far from the only article to posit that such a distinction exists, and has significance to the question of whether we're building a more connected world, or instead a world that only seems so.
I bet the author, Jacob Kastrenakes, was well chuffed when he got to write a headline like that.
> The full and complete solution is to allow me to create a new inbox in Gmail through a single step, for example "j45rsdfjdocusign" which is linked to jsmith747 in a single direction.

When hosting your own email on your own domain you get this benefit out of the box now, without waiting for google to add it for you.

I've been doing this for years, each different company gets a unique email address. Real easy to see who has lost track of their email database, and very easy to turn off those that turn spammy as their business declines and they get ever more desperate to generate sales from their existing "customer list"
We, meaning 3 of us, have automated a greenhouse using Python code running on a raspberry pi -- this includes getting data from sensors within the greenhouse (temperature, humidity, soil moisture, soil temperature, carbon dioxide), from an accurite 5 in 1 weather station outside, and then running fans (intake and exhaust), water pumps and sprinklers, camera, etc... and pump data to web, so that we do not need to be present to see what is happening inside the greenhouse. No code is production ready, but we have had 2 good vegetables crops from the greenhouse already. The problem we working on is presented here : https://medium.com/@pravenj/a-bucket-a-day-a-hack-in-agricul...
Self-taught: My first programming success - using the HN API
Except java doesn't have pointers, it has references. You can't do pointer arithmetic on references, nor can you take addresses and dereference.

I'd expect a programmer to ask: "is this object the same as this other object" and have the language support that by an operator like `is`. Instead of overloading `==` to mean value and reference equality depending on the context.
I concur. The calculus series is amazing.
IMHO I don't think it would fly. The most difficult things of programming are too abstract for that.

You may be interested in the guy that did all his coding with voice for a while because he couldn't use his hands, and still uses it to this day about half of the time. https://www.youtube.com/watch?v=8SkdfdXWYaI
Every time I see maps like this, I'm reminded of WorldCom.

All those pipes running through Mississippi, no real way to make use of them.
6 (Six) Ways to Raise Startup Capital for a Small Business
What qualification do you feel like would handle the situation I described, where more and more people are voting to determine how much income they get from fewer and fewer people? And don't forget: That increasing majority of people has no day job, so they'll be far better suited for political involvement, unions, rallies, etc.

This is a little beyond platitudes about democracy as a concept. Democracy can certainly work, but you can't just bolster and magnify one of its key flaws through policy and shrug off the dangers.
This is really an unscientific claim but I ran a hand crafted/hacked benchmark just to get a feeling for the numbers. For 5 to 35 character Strings, == is 20 to 40 times faster than String.equals().

Given that s1.equals(s2) if and only if s1.intern() == s2.intern() (assuming you haven't filled the string table), then this looks like an opportunity for a significant optimization.

Before doing this, I had hoped that String.equals might check if both were "interned" and shortcut the character by character comparison if this was the case by just comparing references. But interpreting the results of my rough benchmark would suggest this isn't what is happening which would agree with the source provided for the String.equals method.

Java String comparison is absolutely ubiquitous so I would have expected that an optimization like this might have been considered?

Having said that, the supplied rt.jar source also suggests that the String.hashCode() computation isn't cached/memoized. This strikes me as odd given that Strings are immutatable and Strings are one of the most common key type for Maps.
> When are we going to put an end to this security theater that has been proven over and over again to do nothing?

It has not been prove to do anything. That's not the same as being proven to do nothing.
Pressurized by what, though?
I think this is a common misbelief. It has been proven again and again that this is not related to MMR - you will have pricks in every "tier". I can only vouch for the 3.5k range, but friends of mine in 4k-5k say the same thing. There are also a lot of threads on reddit which show that it's not exclusive to "the trenches".

My girlfriend is around 1k and her games are mostly friendly, which is interesting to say the least.

I think there is a point (after a certain amount of matches/playtime) where people start to believe they know everything about the game and start telling people how to behave and how to play, because they just "know it better". This is where it gets ugly.
How to Port iOS App to Android App?
Purify is an excellent ad blocker for Safari on iOS. I recommend it without reservation.