skysight-inc/HackerNews huggingface dataset:
Intuitively, I'd say no. I can't see how you can ever prevent a '51%' attack (that is, 51% of compute power). No matter how many coins you own, the attackers can validate their own holdings and disavow the honest stakeholders.

At first glance, it seems to be a solvable problem because you can try to put obstacles in place that punish attackers (e.g. fining PoS attackers who generate 'false' results). But you cannot make these inducements to honesty bite, the attackers can happily keep churning out false results until they take over.

The problem is worsened because PoS is meant to save wasteful power usage. Honest participants are not likely to dedicate vast computational resources to it, while the attackers will be strongly motivated to do so. The end result seems likely to be an arms race, leading to an effective slide back to PoW, just with added complexity.
It comes from a very old image that floated around on 4chan as long as 8 years ago[0]. In a funny way it depicted how memes and information is spread between the various networks online. I think lots of people from 4chan have understood for a long time how these large digital networks interact with each other and ultimate they later realised how to exploit this over the years.

[0] There are various versions, some include Facebook etc: https://i.imgur.com/aAlOTA8.png
https://en.wikipedia.org/wiki/Kowloon_Walled_City
Ask HN: How are you doing PKI in a cloud environment?
Our organization is using infrastructure as a code approach where we are doing provisioning and deployment of dev/stage/prod environment using Gitlab runners.
Currently, we are using easy-rsa as a root offline CA signing intermediate CA keys manually. Those keys are then used for the Client/server certificate issuing in an semi-automated fashion (CSRs are generated on a VMs, stored into the Vault, and signed by the script).
I am aware of the HashiCorp Vault PKI backend, but we are not using it as it does not solve the actual authorization part of the automated issuing. I was thinking about using ACME based CA like Boulder internally.

My question is, what is the best approach to do PKI, when there are lots of new short-lived VMs/containers wanting their own SSL keys.
How do you define successful single-person? I've been running a one person consultancy for 12 years now, had to retrain quite a bit over the years, sometimes it was so busy that I outsourced pieces of work. It's been good enough that I have a house and no mortgage attached to it, all while spending almost enough time with my family - much more recently.
This is what I wanted and I consider that a success in maintaining a work/life balance, working from home and having a good life in general.
It's not quite 'fu' money yet, as I still ahve to work for a living, but I working towards that goal.
I know a few good people that agree with this point of view - Basecamp/37 signals folks etc.
PewDiePie
> The computer science AI/ML work has obtained some good results; just why the techniques work is too often still a mystery. But the emphasis on gigantic quantities of data make the work a niche and real applications rare.

From an industrial point of view, that 'niche' includes a large proportion of the consumer internet and the 'rare' applications include online advertising, which powers two of the four most valuable companies on earth.
If you're from Italy, Spain, or France to name a few, you do drink a glas every day. But either way, a single good bottle of wine is at least a pound of good coffee. Few people drink that much coffee.
To answer my own question, this is a good resource:

https://www.lvh.io/posts/nonce-misuse-resistance-101.html

In summary, it makes the nonce a function of the message as well, so you always get the same nonce for the same message. Presumably, the attacker only sees duplicate messages rather than plaintext because XORing a message with itself yields zero.

This is one of the things that make you ask "why didn't I think of that?" when you hear of them, and I think that's generally the mark of an ingenious idea.
Build your own next generation view library: 1kb vDOM builder and patch function
> Would love to know the whole story behind this.

He actually did an interview with Rolling Stone [0] where he told his "story".

[0] http://www.rollingstone.com/culture/news/the-flight-of-the-b...
Anyone suggesting something over the older tech should be able to explain why. And alas, as you write a lot of times, this explanation phase is simply skipped and only the impulsive shaming remains.

However, that doesn't mean the new libraries/tools/technologies are just created because "oh it's been a year and we're still using knockoutjs/react/angular/webpack/yarn!", but because a slight paradigm shift happened - at least for some people - and they feel that backbone is not the ideal tool for their job. (Maybe they felt backbone is too barebones, and went for angular, then felt that too heavy, and tried React and settled for Inferno.js.)
It's incredulous that a person can single-handedly run a product as complex as that. Builtwith isn't a low-maintenance CRUD app, it's a beast. It crawls >100M websites, searches for thousands of signals, monitors their usage, finds lead information, and serves them to thousands of customers. The signals need to be constantly updated; crawler needs to handle tons of edge cases; and not to forget, you need to deal with people's issues. I am in utter disbelief one person can do everything, even if I account for being an automation freak.
Pretty much. Take the example in the post: the web server is Racket's web server with an FFI wrapper. So you're using an API that was never designed with Hackett's type system in mind. So now you've got the choice between exposing an efficient or an idiomatic interface. And so on...
> If we disagree with a law, we should change it.

Agree, but that doesn't happen instantly. Changes come time by time, after occasional breaking unethical laws (while they are still active) - e.g. unlawful freeing of slaves, helping Jews during Nazi regime, etc... These are all examples of breaking unethical laws, which should happen and will happen.
Very roughly, this is using a hash of the data mixed into the IV (so IV+key re-use means same plaintext always gives same ciphertext, but not catastrophic fail like re-using IV & key in GCM).

I wish the library support were better (e.g. common java libs), and that it would get added to approved cipher lists from various govt. bodies. I'm not across how this really happens so no idea if it will, but I really hope it does.

I like how hard to get wrong SIV mode is, and how, as a primitive, it lines up quite well with how developers think encryption works before they go do coursera or the matasano challenges or whatever.

In my experience developers don't really get better (as an entire class of people) at security, most of the improvements in security I've seen, I attribute to better APIs and outsourcing of low level infrastructure to highly resourced entities.

Yeah so it's a bit slower and your data has to fit in memory, but within these application caveats I see no reason not to universally prefer automatic IV modes.

You still have to care that its deterministic in a lot of applications but thats not too hard to communicate.
hmmm... It is OSS though. Not sure we can consider it as a single person company.
There certainly are github employees who contribute a lot to git, but not with their github e-mail address, but with their personal address.
> I haven't worked with .NET and C# for years but I bet I could feel right at home today

You'd be surprised. It is shockingly different now - they are in the early stages of exactly what happened to JS.

I'm sure the outcome will be really beneficial for everyone, but at the moment it's very confusing if you aren't constantly monitoring it and keeping up-to-date.
Hi, maybe I am one of the people who you would say thinks, "Let it be illegal, but let's keep the border-jumpers as our empathy pets." Let me try to explain the thinking (which, by the way, has nothing to do with some sort of paternalistic moral smugness, as you seem to be suggesting).

With immigration, there is a situation where (at least in my opinion) it is not morally wrong for anyone to illegally immigrate to the US for economic reasons, yet it may be that the US should not allow unfettered immigration. It is true that in some cases a behavior can be morally wrong only because it is illegal (e.g., violating corporate disclosure requirements), but making immigration illegal is not enough to make it wrong because most illegal immigrants have compelling reasons to immigrate and are not doing any clear harm (not shooting border guards to get across, for instance).

It is true that, as a general principle, we are better off if we can arrange that only morally wrong behaviors are outlawed because that somehow makes people more respectful of the law, but in the case of immigration, it isn't possible without allowing unfettered immigration, and that may be too high a price to pay.

What we can do to improve alignment is to allow anyone who manages to come to the US and remain for a certain period of time (say five years), and perhaps to meet some assimilation targets (like learning English), to stay and ultimately become a citizen. Then it will be more reasonable for law enforcement to aggressively pursue illegal/undocumented people, and the "rule of law" can be stronger.
innovation into "more powerful/better
language mechanisms" has stalled, for
some other reasons.

For sequential languages there is probably not much to improve -- except at the edges. ML nailed it. Almost all core PL research today is about

- verification

- concurrency/parallelism

because both are beset with deep unsolved problems: for verification the problem is how to do it efficiently (we know we can do it in principle), and for concurrency/parallelism we have not yet discovered core abstractions including the right types that can express simple properties of concurrency/parallelism (at least that is my working hypothesis). This is intimately related to our current inability to auto-parallelise.
I mean that, if they're living, quitting the game is literally murder. Keep in mind that an intelligent AI wouldn't be hurt when you shot an NPC any more than a show writer would be hurt when a character got shot in the show.

There wouldn't be one AI that felt pain per NPC, it would be a general orchestrator deciding which NPC to make cry and how they should act.
Ideal is entirely dependend on brewmethod, bean, preference, and age of the roast. I very rarely go above 1:15, and often closer to 1:10 for pourover. For espresso it's a different beast, but usually something like 18-20g pr cup.
Artificial Intelligence for Games (2009) [pdf]
IIRC, it was about a $600mm exit.
I came here to recommend this. Crowley's book on the siege of Constantinople is great too.
An ARM CPU is not exactly a self contained system like an x86 CPU, it is very dependent on the rest of the SoC.

Qualcomm and Apple have their own tricks which work very well in their platform alone but they wouldn't be able to simply plug out their ARM implementation and sell it as a really optimized system without their own SoC.
Voronoi tesselation is also a step in K-Means, which is one of the most well-known clustering algorithms (typically used for quantization). Here is a page with an interactive visual example for it: https://www.naftaliharris.com/blog/visualizing-k-means-clust...

Note that the DataGenetics article talks about 2D Voronoi cells but they (and K-Means as well) can be generalized to a space of any dimensionality.
Stardew Valley: http://stardewvalley.net/
Who do you have in mind? Maybe

https://en.wikipedia.org/wiki/Alexander_von_Humboldt
because the JIT will fix it

This has not been borne out in practise. Moreover JITs are much more complicated and hence expensive to develop to maturity than standard AOTs.
I don't have any direct info re: mineralocorticoid effect on renal reabsorbtion of calcium, however the interaction of sodium and calcium has been studied as it is important in kidney disease, for example kidney stones, and osteoporosis as well. Here is an article on an excellent site that discusses some of the significant aspects of sodium/calcium regulation: http://kidneystones.uchicago.edu/does-too-much-protein-incre....
The facts are clear. No effective mirror system or failover system. I've architected major 365x24 systems repeatedly in my career: Removing the possibility of power supply failure across the primary and secondary sites (and even within single site) is absolutely fundamental. That clearly has not been done here, at least to the extent of making sure that the solution is effective- and the blame I would guess lie within a crazy management and decision structure that seems to increasing permeate IT within large companies. Tata do have some good staff (from my first hand experience over many years):However, from my more recent experience, there is an increasingly MASSIVE CLIFF EDGE in talent/competence in within Indian companies generally, (and to some lesser extent UK companies as well): So the possibility of having "very assertive, but stupid or incompetent" middle and even senior managers is becoming an ever greater real-world problem. The criteria and method for selecting candidates for IT related work does not help - in particular role, competency, and "modus operandi" of recruiting agencies, is pretty atrocious, as many a seasoned contractor will attest! But ultimately, I think Alex Cruz and his CIO must take responsibility for a lack of diligence and competence. They clearly do not understand the most basic truth of high reliability, mission-critical IT: i.e. They NEVER needed cheaper IT staff (with all the attendant risk within their industry) , but rather much fewer technical staff, of the HIGHEST QUALITY, for all BA's key systems. And that I’m afraid means probably not putting Indian companies at the top of the list.
Point two is an example of the developer talking to the tester, how to test and how to avoid the pitfalls. Thats an unwanted situation. Always write down why you changed something, especially when you know it will break things.
Camas Tren
Crowley's Empire of the Sea (mentioned elsewhere) talks about this a lot.

We talk about the knights now as though they were some kind of priests, but in reality they were pretty much ferocious pirates with a religious sanction.
I admire your compassion for your fellow human being. I mean that sincerely.

I also have a word of warning:

>"hey, buddy, sorry you're having a hard time, but I don't see any RF orgies being beamed to you. Have you talked to a doctor?"

Is a potentially dangerous thing to say to the genuinely ill. Like you said, no one can talk someone out of it, just like you can't talk a diabetic out of an insulin crisis. It is a physical ailment. While most schizophrenics are not violent, some are, and the ones that are can be deadly so. One of my high school teachers, who was a wonderful, warm woman, was recently murdered by her schizophrenic son during one of his episodes. He had never been violent before, but his breaks from reality were getting worse, and one day, that was enough. Just be careful of your own self, too, when offering a hand of help.
Playful London escorts is balck to your back
I've marvelled at builtwith since I found out it existed.

csallen, if you're reading this, get Gary Brewer to do an interview for IndieHackers.
Sublime Text was for a long time a single-person business.
I built and run Instapainting.com by myself. As of the date of this comment it is still only one employee (me). https://www.indiehackers.com/businesses/instapainting

Things like customer support is outsourced to other startups, and of course the artists on the platform don't work for me, but could be if the company was structured differently (it's structured as a marketplace).
ImageNet came from the United States. You know, the dataset which AlexNet succeed with? Oh right, there's MNIST too. That's from the LeCunn at NYU, also USA. What about the GPUs? Well that goes to Taiwan.

Canadians are upset all their talent is flocking to the US. Even Yousha Bengio's brother works for Google.
Show HN: New and Better Docs Index for the Froala Rich Text Editor
esr/open-adventure: Author-Permissioned Forward Port of Colossal Cave Adventure
To add to the sibling comments, it might be better to think of ARM less like intel, and more like lego for building processors. Standard kits with a sensible collections, but you can always just ask for the IP blocks and diy. If a vendor discovers something isn't working for their application, they can turn it off, build a core without it, tell the compiler not to use that feature set. It's very modular.

additionally: x86 grew up on devices that were basically always plugged in. ARM has a huge install base thats significantly power or heat constrained.
What is unethical? Engineers make guns, missiles, drones to bomb people, warheads, nuclear submarines, ... .
TheHun.net, run by one person for years and still doing well over 1M a year in revenue.
The article mentions Delanuay triangulation, but it doesn't mention that one way to calculate a Voronoi tesselation is to calculate the Delanuay triangulation first.
This is me, too. My wife complains that it's like I'm trying to have two or three lives instead of just the one. But I know I need the sleep I'm not getting, but I have a really hard time, once the kids are finally asleep, just going to bed myself. When everyone but me is asleep it's so peaceful and quiet, and I can read, slay work dragons, learn stuff, or just veg. Unfortunately this usually results in maybe six low quality hours of sleep. And I pay for it in distractibility, moodiness, not as smart as I am when well rested, etc. But overcoming the size of deficit I've got isn't pleasant either. I actually feel worse much of the time. More tired, speak less clearly, slow thought... It sucks. I probably just need to stick with it until my brain and body adjust and recover, but just haven't gotten to that point yet. My growing concern is that not enough sleep and poor quality of sleep can literally, indirectly, kill you (via things related or compounded by lack of sleep). Yikes! I'd like to grow old with my wife, and see our kids grow up. So... Gotta beat this problem somehow!
Safari view controllers are completely separate - it is not possible to implement any kind of checking with it.

However Safari itself does do a reasonably good job of checking the certificate, and the view controller does show the hostname at the top.

Doesn't stop you from just faking the UI though
Defence in depth? An extra layer between an attacker and your secret data is rarely a bad thing.

The tradeoff against convienence is worth it for some environments. E.g. what if AWS has an issue with applying security groups properly and it fails open?

Arguably, failing open is the right thing to do in some cases as it avoids causing an outage for your users. However it does expose them to a risk they may not have been prepared for.

I know OpenStack had an issue a few years back where, when the component responsible for managing the security group rule implementation was reset, it failed open until all rules were rebuilt (at the time, this was implemented as iptables rules on the hypervisor's). Another bug (well, poor implementation) meant it could take several minutes or more to rebuild the rules.

It happens, and you should be aware of and understand the risks of things like this happening when designing your infrastructure and choosing which tradeoffs are worth it for your particular use case.
Nice site, and a great idea.
Thank you for taking the time to respond. I now understand what you meant "Educated adults should understand" - as in, the educational systems should make way for this, rather than a swipe at my education or status as an adult ... such is the Internet. I'm quite well educated in the ways of the law however, to the point that I understand how flimsy it can be in certain areas, and your central thesis is far from having closed endpoints. In any case, I apologise in kind for what may have been a bit of a hissy-fit.
There's a good deal of variation. Without digging into how that figure was produced, it could be worthwhile to mention that the production process Jay Ruskey says he's interested in cuts a lot of water out of the process. Once coffee cherries are picked, getting down to the seed inside (aka "coffee bean") can happen one of roughly three ways: "natural process", letting the coffee fruit dry out like a raisin on the seed; soaking/fermentation, letting the coffee soak in water for 24-48 hours once (or often twice in Kenya); mechanical demucilagation, separating the seeds from the rest with a machine. The demucilager is common in Costa Rica. I can dig up some more material later, but the government in Costa Rica is strict about water waste, essentially requiring farmers use demucilagers to process their coffee. I don't know how much this would affect the water involved in coffee production, but I would guess it would drop the amount necessary for production in cases like Ruskey's.
DIY scarification, bring your own cat.
Cybersecurity: It's time to make security a priority
I like the idea, but I am afraid that as long as there are no "big names" behind it, it isn't going to make much headway in the conservative world of science. As tough as it sounds: reputation is the currency of science, and PCiX needs to get some before it can become a viable publishing alternative to the established journals.
Serious question: what benefit does this (.mjs) have over the current way of doing things?
When he sold he had plenty of employees but still owned everything.
OMG! Is that so?
I'm sure you know this, but for a fraction of that cost you'll get a green top grade coffee bean. Roast it yourself so it's always fresh. You won't look back. I've tried robusta. It looks amazing but is deadly strong and tastes like burning tyres.
5 of the Best 7 Seater SUV Cars in UAE
His primary job is an employment, not his own business. He reports to his coach etc.
His side businesses like marketing the CR7 brand is most likely outsourced to a large degree with little to none daily activity by him.

A singer writing his own songs or an actor always looking for roles to play might be a business, while typically they are controlled by a record company or movie studio, which again isn't really like running a business on your own.
2017 KLAS Report Names Epic, InterSystems Worldwide Frontrunners
Why this happens has been explained, but more generally what you posted really doesn't prove anything at hand really. The dictionary created from scratch could be made an updateable view by hooking __setitem__.

If you gonna contradict with "are you sure?" for something so objectively answered by the source, it might be helpful to think if your example actually demonstrates what you're trying to prove.
With "dynamic", I mean "pulled in at runtime" vs. "pulled in at compile time". See http://2ality.com/2017/01/import-operator.html
It's still a single person company (as in, the company with only one employee). The fact that more people contribute to the company's product doesn't change that.

As long as other open source contributors are not payed for their contributions, I would still qualify it as a single person company. It's just that the company's approach is a little bit different than the traditional one.
>JS is backward compatible. So it got that too from Java other than the funky name.

You mean forward compatible. Which is unlike in Java.

New code (e.g. with ES6 features) doesn't work in older JS engines / browsers -- that's why we have transpilers.