skysight-inc/HackerNews huggingface dataset:
It is shocking to me to see how many developers giving this checklist a hard time. Every single item is solid advice and what I would have presumed sane people considered common sense/best practice.

Just goes to show how bad a job we have done in the InfoSec world of educating developers.
I always wanted the file system to be built on a version control.
intern() should be internal; not a publicly exposed 'dongle' switch. Never used it. Won't ever need it.
It mostly stays in my pocket, and is often set on silent. It is never in a room where I'm sleeping unless I am using its alarm function. I rarely think to turn it off, unless for some reason I've let the battery run low.
Rather than my usual tirade against open offices, I would point out that options for subvocal voice pickups exist like throat mikes. You could speak softly enough your neighbor couldn't hear you, and they also attenuate external sounds quite well.
Airbnb wants to remake the entire travel industry
No. Absolutely not. After they were acquired by Conde Nast, it has been downhill at an amazing pace.
What+is+Blockchain+Technology?+A+Step-by-Step+Guide+For+Beginners
This is the problem Meteor had. They had this complex allow/deny configuration to see if the client has permission to run a query but it was impossible to get around all the edge cases. They started recommending not using it and instead call controllers that then would check server-side if the user has permission or not and return the data to sync to the client. Then every query client side is considered to have full read access to the data in it.
All significant modules, whether facing the Internet or internal to a large system, should validate their inputs to prevent propagation of BadThings(TM).

You can choose how much to validate, which is probably more in the former case, but it should be done.

I can't tell you the number of horrors I'm sure we've stopped in (for example) investment banking pricing by avoiding trying to do calculations on junk when the junk was easy to spot. (We also added one or two, eg when one set of interest rates went above 100%, but that's an after-dinner story!)
The page has no description of the features. From the guides [1] it seems that the main features are file sharing and versioning.

The recommended way to run an OSF instance is with docker-compose.

https://github.com/CenterForOpenScience/osf.io/blob/develop/...

[1] https://osf.io/support/
7 Reasons Why Outsource Software Development from India
CRC Part 1: Programmer vs. Compiler
He's correct in the sense of trying to catch SQL injection via input validation - that's a losing game. He isn't saying "don't validate your data at all", that's a different issue. Ultimately, your OWASP issues (XSS, SQL Injection) related to input are going to be prevented by appropriate escaping and data handling across your entire stack by default (key word is default, "trust the devs" is not the right answer). Input validation isn't the ticket.

This is a prime example of the Robustness Principle.
https://en.wikipedia.org/wiki/Robustness_principle
Alan Kay on how many books you can read in an year
> This desire to reduce human interaction is driven by the desires of the average consumer.

Yes, every example Byrne gives is opt-in. Want to increase human interaction? Simply don't use these new services.
The first stage has a fuel mass fraction of 95.5%. Propellant densification and high thrust to weight ratio engines buy you lot. That should be enough to make orbit.
Sounds like "Have I Been Pwned?"[0] which I have been using to identify which addresses were hacked/sold. Together with a unique email address per site registration, which all get captured by a catch-all on my domains, I have some information on which addresses are compromised.

[0]https://haveibeenpwned.com
Having a system encrypted at rest is a huge reduction in legal liability under HIPAA. It may be similar in other industries. On the other hand I might not care if someone stole my recipe collection.
I don't store lossless because I think I sounds better. The idea for me is I can transcode to whatever format I need without generational quality loss.
Impossible, this is theoretical at best.
Should users have any reputation before creating new challenges or making translations?
Chicago has a few of those as well, though the Kluczynski and Dirksen Federal Buildings were designed by Ludwig Mies van der Rohe, and the Daley Center by Jacques Brownson.
MP3 has been "dead" to me ever since the non patent encumbered formats started becoming popular. Mind you, I've been using Linux as my primary desktop OS since the mid 90s... So I have a vested interest in open formats.

These days, all my music is in a lossless format anyway. Especially now that my phone has enough storage space for it.

Anyhow. I'd say that if anything... The patents expiring way the heck sooner would have been healthy for the format.
Looks useful for image problems. My personal interest is using CNNs for natural language processing. The same sort of tool that allowed viewing parts of the network as the sliding window on input text moves, etc. might be useful.
AngelList is funding the minor leagues of VC and giving founders $500k to start
Another non polling option: http://www.brendangregg.com/blog/2014-07-25/opensnoop-for-li...
Maybe more like savings. Trade goods.
Modern compression schemes are better, but for most people the difference is academic.
Docker and Python, sharing my development experience this far :)
I have the same setup. I was never able to make Keybase work with GPG on a Yubikey. Did you have to jump through hoops to make it happen?
This is the truest statement in the whole thread.
Its not disdain... its a recognition of effort. Most of us with 100k+ jobs, have put in the time, went to school, gained experience... etc...

The last time I worked minimum wage I was 16... because I decided pretty quick i wanted to do better than minimum wage...

Nobody is forced to work a minimum wage job... it might be hard, but it can be worked out of... but there its difficult so most dont even attempt it
big companies have "we need licences for everything" people.
Wow - looks a great book - thanks for doing this, and thanks to your helpers
I just downloaded Ardour (after trying it out a while back and somewhat giving up) and it's a pretty fantastic application.

What prompted me to get into it again was that I wanted to combine it with Hydrogen (http://hydrogen-music.org/hcms/) using JACK (http://www.jackaudio.org/).

I can _immediately_ see the power of JACK, but I just can't get my immediate use to work, which is when I hit play/pause in one application, the other starts as well.

In general though the potential in JACK just seems awesome, it's almost as intuitive as just routing patch cables in meatspace and I can't wait to get into it more. It also seems like something that'd be brilliant for a touch-screen.

I'm considering setting up another partition just for audio work.
Data, logic and presentation sounds a lot like model controller and view. I feel like you suggested most logic should be in how days is handled? But let's be serious here, there's no right way to make a web app. There are certainly wrong ways and inefficient ways. If we focus all our efforts on doing things perfectly well then we would miss the point. Essentially, you're just theory crafting how people should code while ignoring the practical issues of people and coding.
It does seem like emails are a good fit for encryption. I can't see wanting to do anything more than simple equality checks.
Yes, in fact that's one of our main use-cases. The behavior right now is very simple: it just looks in the target directory for the latest checkpoint. So if you're checkpointing regularly, you should be fine. We may implement a checkpoint selector or something more sophisticated in the future if it turns out lots of people are using it that way.
It's not CI, it's just CI Theatre
Agreed on the general principle, but note that the incidence of SJS varies by drug. For example, lamotrigine causes SJS in 10-30% of people taking it, depending on how fast the dosage is increased.

There they don't address it by trying to predict who will show SJS symptoms and who won't; they just put people in it slowly (which reduces incidence) and take people off the drug (or hold at a given dose until the body accepts the drug) if they show symptoms.
I've used it for recording music, combining some MIDI tracks with many audio tracks and samples. Once the audio system was set up and stable, working with Ardour was a pleasure and results were very good.

The main problem was getting high quality effects/plugins, paid or free. There are a couple, but in general life is much easier in this sense outside of Linux. That was 2-3 years ago, and hopefully things have improved since.
Pickxit – revolutionary smarter and easier online shopping
Hello folks,
I'm happy to introduce Pickxit !
Pickxit is solving a big problem for us, the online shoppers:
Find the right item takes long time and effort'
We use smart technology, to make our life easier, when we need to purchase products, online.
You are welcome to try our beta version , enjoy it and share your feedback with us :
www.pickxit.com

Thanks,
The Pickxit team
Show HN: PostgREST Starter Kit – Boilerplate and Tooling for Authoring REST APIs
I actually did click the "Allow Flash" button, but only to find that the page hanged and I had to kill it. Quite underwhelming so you didn't lose a lot
A Look Inside Apple’s New Campus
Hi, about port 22, you can use ssh keys and disable password access, see: https://aws.amazon.com/articles/1233/
I'm glad you mentioned that. After watching this it made me wonder if this is normal, or if this guy is some sort of auditory wizard. It seems like an awful lot of work to master, but maybe not if it's a skill you're using everyday.
Would you be so kind to explain me the attack vector if the user input is never possibly treated as part of the code?

What I came up with is this: user name is stored in the database, and some new junior developer in a large team reads it in the backend code, and immediately plugs into another SQL query using string concatenation. BOOM!

But on the other hand, the very same junior developer can forget to sanitize the inputs before storing them (or do it incorrectly), so there.
This would make for a great anti-spam mechanism. Kind of like the ultimate captcha. If quality / spam ever (inevitably) becomes an issue, I will absolutely require a minimum REP / XP.
Have you tried FZF (the fuzzy finder)?

https://github.com/junegunn/fzf

It integrates well with UNIX shells, editors (VIM integration is excellent), git log search etc. It's really versatile.

Of course, there is also q:

http://harelba.github.io/q/

for something that is more like the software described by OP.
Mobile Debugging Made Easy
WannaCry ransomware cyber-attack 'may have N Korea link'
Thanks for this, I'm planning on developing a small web application over the summer for one of my gaming interests and as I was reading this I was wondering how practical any of it would be for my project. Don't get me wrong I plan on building in security but I'm planning on building a Rails app were the most sensitive data contained is an API key, it would hardly seem practical to build Fort Knox.
"Congratulations, here's your first set of glasses" - the present I got when I turned 50.

While the site focuses on seniors, a lot of the suggestions are good ones in any case - fonts larger than legalese and with good contrast will make your page more easily approachable and less likely to lose viewers who get frustrated because they can't read what you're trying to say.
Does your architecture smell? – A case study
A Brief Introduction to JavaScripts Async Await
How the Venice Biennale is tackling the refugee crisis with art
The Best Blockchain Developer Tools List
Given that Uber is using the "we had no idea this happened" defense, they were already forced down this path earlier: http://www.businessinsider.com/anthony-levandowski-no-longer...

So, not terribly newsworthy.
...and this is why Gerard 't Hooft, the famed theoretical physicist, can't register with his real name nearly anywhere. :(

https://en.wikipedia.org/wiki/Gerard_%27t_Hooft
It is kind of soul crushing to work on a problem only to be denied execution. Thankfully, I ran an easy JS challenge that was a one-liner. Had I done a a harder challenge that took 10 or 20 minutes, I would have been rather upset.

I understand why you put the registration further into the process. People have already invested time, so they might as well register so that the time isn't wasted. This is markedly different from how the rest are. They either put registration up front (HackerRank) or you're required to validate your own code (cryptopals). Aside from intentionally infecting my computer with malware or something, I couldn't think of a more negative user experience from a code challenge site.

These types of sites are far from unique. They are basically a dime a dozen. But now my experience is, "Don't make the same mistake I did. It gives you an input field to submit a challenge, but it will not validate your answer until you register. Either register up front, or don't bother."

Edit: This post was intended to be constructive, but I can see how it can be interpreted otherwise. See here[0] for more info. Apologies!

[0]: https://news.ycombinator.com/item?id=14349780
Ransomware WannaCry: Cybersecurity Stocks Are Beating the Hackers – Fortune.com
Techmeme heading/summary:

"Fraunhofer, the major contributor to MP3, shut down its licensing program in April as MP3 patents expired — Red Hat has announced that Fedora will include official MP3 decoding and encoding. The reason is that MP3 is now patent free - as far as anyone can tell."

First linked (Engadget) article:
"MP3 is dead, long live AAC.
Its creators have abandoned licenses to the format, signing its death sentence."

Not clicking would have both saved you time and left you better informed.
>suddenly being able to do nothing is not typically a situation most people find themselves in

And when people do find themselves in that situation they have everybody and the world yelling at them to do something "useful" with their time because as you say this has a lot to do with culture. Maybe doing nothing is perfectly fine? I don't see other animals constantly hustling to look "busy" for the sake of looking busy. Let's also keep in mind that most people usually don't just "do nothing", if they have an actual choice then they tend to do things they enjoy which is at least something.

>There's a definite link between what we do, and our identity and how we see ourselves, and our value. It's easy for people to get depressed and isolated when they do nothing. It's easier for negative habits to set in with fewer checks.

Of course, there is and it is a very simple link: People often excel at the things they enjoy doing, force them to perform tasks they don't enjoy/see a purpose in and you usually make people miserable regardless of the monetary compensation they receive.

That's the only way work functions as a "check" to keep people happy if they see an actual purpose/value in it and don't experience it as "working for work's sake" because that might just as well be considered crypto-slavery. In 2013 David Graeber wrote a pretty good piece about this Phenomenon calling it "bullshit jobs" [0].

>And just like you think that "there" would be a millionaire, I say it's just being at the end of life, and not having too many regrets.

Sorry I might have misunderstood your point there because I interpreted that part as the usual "American dream" story of "everybody can do it if they just put in the work" which I consider BS not just in the US but pretty much everywhere.

>I wonder how that would change if we were challenged less. Or would we simply challenge ourselves more?

Keeping up in the rat race takes a lot of time and energy that's why (imho) many people would challenge themselves more once they are freed up from cultural expectations aka the challenges forced on them by society.

[0]http://web.archive.org/web/20130818200653/http://strikemag.o...
I don't know that that's true. I'm by no means, even remotely, an expert. But it sounds like you've got a "hidden variables" take on it; that you're suggesting the probability wave is our statistical prediction of a systems state limited by our ignorance, which is what Einstein believed, and has been since contradicted by physical experiment showing violation of Bell's inequality? Am I mistaken? Feel free to correct me.
I'd recommend you start with the items at the very end of the check list. Make a list of the threats and plan who you need to defend against.

That will then allow you to cull the list down.
Alternative Patterns for Method Overloading in Go
I know it's no where near the same thing. But this reminds me of when I broke my arm very bad as a kid, and was in a cast without the use of my fingers. I learned how to play Mario Brothers and Zelda with just my left hand in a few weeks. Besides a few key combinations, like working up speed in Mario, I ended up being better with one hand than two.
Apple to Release iPhone 7 and iPhone 7 Plus King of Glory Special Edition
larger click targets also help with users on touch devices. Apple recommends a minimum of 44x44px but around 30-35 upwards is usually fine.
I'm not sure I see the economic advantage.
I don't know. When I watch games of 4k on youtube, people seems more civil honestly. But maybe there is just a filter effect.

What's annoying is that I don't think you can pinpoint a factor that triggers rudeness. Yes, you have the typical insult following a failure to play up to the standard of some of the players. But you also have people just being uneducated: playing music with auto mic on, gaming like they are alone, feeding because they didn't get mid, trashing the enemy team... It's like being in high school all over again.

It's are
Something like this exists already
http://www.submarinecablemap.com/

I found this to be much better
Don't look forward to the business owners wanting to spend money on humans "brainstorming in a coffee", though.

I fear that my favourite genre -- cyberpunk -- is getting closer to reality with each passing month.
Enrico Fermi and the future of venture capital
Functional Programming Design Patterns
I came up with this technique when designing our platform (https://qbix.com/platform) so I don't know if it's widely used.

Many apps include session id tokens in requests, to identify the logged-in user. The session id is usually a bearer token (like in a cookie) which identifies the session on the server.

To mitigate against DDOS attacks, as you said, all publicly available resources can be cached on CloudFlare. (Personally I look forward to content-addressable protocols like IPFS supplanting HTTP.)

However, the non-public resources are usually dynamic and should not be cached. These resources are typically for users who have logged in, or at least have a session.

So our design basically encourages this:

1) if you want to serve non cacheable resources, require that the request included a session id

2) the session id is generated on our server and signed with an HMAC so the app can verify this signature without doing any I/O.

This is because I/O is expensive and hard to parallelize, whereas statelessly checking whether a session token has been issued by our app is easy to implement, even at the external router level. Simply examine the packets coming in, decrypt, look at the request, and verify the HMAC on the session id. If it is wrong then the session id is bogus so we don't expend any more resources within the network on this request.

You can make sessions expensive to start. For example, a user might have to log in with a valid account to get a session.

The big question is, how can we ensure that users don't get too many accounts? To prevent sybil attacks. Any ideas?
Talent.io grabs $8.8M for its recruitment platform
Consider the New Banana PiR2

It is supposed to have GBit Ethernet now:
http://www.banana-pi.org/r2.html
I wouldn't be surprised if people prefer the low bitrate MP3 songs because that's how they've always heard it. Most people have never heard "good" audio.
Would say Algebra (and Linear Algebra as mentioned below) are the most useful to learn for ML/AI?
You could design a keyboard for it on Android at least.

Make the whole keyboard area a blank "tap zone" where you can just use any digit to tap text into an input field.
Introducing Face Filters and More on Instagram
William Gibson’s Never-Filmed Aliens Sequel
> Hashtable is synchronized, slow and thread-safe, but doesn't mind NULL.

The issue with Hashtable or rather all legacy collection classes is that the API is rarely useful without additional synchronization. So you might as well use a HashMap wrapped by Collections.synchronizedMap or use a ConcurrentHashMap with a placeholder object instead of null.
Blender is another excellent example of this.
Assuming it doesn't create a market for actual robots.
IMO both are true:

(1) Business wants less costs.
(2) Introvert engineer subconsciously model their tech products after their lack of desire for human interaction.

One doesn't exclude the other. I've witnessed both, numerous times, during my career.
I think the term is "gravy train".
A "slang" term for a perfectly legal profession (where I'm from) used in a derivative but substantive manner--it's obviously short for the phrase "attention whore" (which is really the main reason why you shouldn't have moderated this remark) and this type of journalist is doing it just for the attention to make money, which is relevant because it sheds light on their motivation behind their questionable actions. The phrase couldn't be more on-point, actually.

Which leaves the "civil" part. Because he said "whore" instead of "prostitute".

Certainly from now on, you'll be moderating people for using the ugly word "hacker" instead of "security consultant/researcher", right? It really (still) has the same bad name among people not well-acquainted with the biz. And no, it doesn't matter that some people chose to wear the "hacker" title with pride, because guess what? So do most whores.

To add substantively to the discussion myself, here's an open question. I'm having a real hard time coming up with a phrase two words or less, that communicates this aspect of journalism as accurately as "attention whoring". How would you say it?
I doubt that. There is some sort of program like that in Norway. Im still a bit fuzzy on the actual details, but the employer sends you to appropriate schooling - the dude I knew went 2 days a week, one was a paid workday and the other was on his time. He had to pass the tests and agree to work there for x time, otherwise pay back the training costs. He's left with a valid, transferrable degree to other similar places - the degree would be similar to an associates.

Another solution I've seen was in the US. Some pharmacies will train pharmacy technicians and incur the expenses themselves. The tech license, however, is only good so long as they are employed at that company. (folks can pay for such training on their own dime, which can transfer between employers).

And yet a third solution: I looked into becoming an electrician in the late 90's (in the US, specifically Indiana). The local electricians union provided schooling and training, no cost to you, so long as you stayed with the union employment for something like 4-5 years lest you pay back the schooling costs. I'm pretty sure the local plumber's union did something similar.

Both countries have methods of reclaiming such money - the court systems. Both can withhold money from your paycheck for such things as well, if you don't pay. In the US, that amount is something like 25% of your paycheck, so long as you are left with 30 hours wages at minimum wage. In addition, they can likely take away any professional licenses you obtained until you pay it back.