skysight-inc/HackerNews huggingface dataset:
My bank (well a credit union) called and asked if I really wanted to buy 4 tires. Since I was having a bit of an issue paying it without the money in my checking account, I said yes. It surprised the heck out of me too.
*she

Yeah, it probably wouldn't have mattered to him one way or another, since he was apparently a happy and gainfully employed adult, but it's helpful to remember that autistic people have always been here, not some recent invention or "epidemic".
Can you elaborate on your thoughts here? If you just wanted to target the Dis VM using Go as the starting point, I believe you could call most everything in the standard libraries.
Who is working on better routing protocols? Displacing BGP seems like a monumental task so it seems like bgpsec is about as good as we are going to get. Would love to be proved wrong though.
PivotalCF is expensive, but that's due to the clientele we target and the various added extras we can provide.

OSS Cloud Foundry is free, and so is BOSH. A lot of companies use those and are perfectly happy with them.

Red Hat OpenShift undercuts us on price, I think largely because they figure they'll get to do the razors/razorblade thing with RHEL riding in behind it.
> But if vendors does not want to upstream them as free software, then we have a problem and an issue with the non stable ABI solution. The end user does not care if the driver is free software, they just want their machines to work. I guess this is an issue for Google too, for their Linux fork Android.

You're saying this as though the end user experience is separate from improvements to the performance and semantics of the driver ABI.

Also, on Android all of the (kernel space) drivers are free software; it's just that they're so crappy usually that they can not be upstreamed. They don't hook into much of the infrastructure in the kernel on account of ignorance, so they could easily push updated kernel module binaries, ABI compatibility does not affect that problem.

Android's kernel is not a fork of Linux, it's a LTS tree with some configuration changes, and a couple of modules (most of which have been upstreamed by now).

> If Windows can have a stable ABI, why can't Linux have it too? Why would it need to "reduce the quality of running kernels"?

Windows doesn't have a stable driver ABI, they break driver ABIs pretty drastically every once in a while.
Longhorn (later yielding Windows Vista) was the last straw, they couldn't build a good quality operating system with the same driver ABI.

Furthermore, drivers from Vista often do not work with 7, 8, or especially 10. You can get the exact same sort of stable driver ABI by distributing for a specific distribution release or long term kernel tree.
An interesting thing to note is that .pack files give you some safety against this sort of disclosure. Bare git objects are very easy to access even with indexes disabled because their name is their hash (and so if you have access to the index or the current HEAD you can recreate the history). Pack files contain multiple objects, but their name is computed from a hash of the packed objects. This makes it quite difficult to figure out the path to the pack file (you have to brute force the entire history and how it was packed in order to get a single .pack file's worth of data).

Not that you should have .git exposed on your public webserver anyway. I do remember participating in a CTF that had a problem like this a few years ago, it's possible that it was the same one the author mentioned.
I'd look at research efforts that have been focusing on revising the heart & original spirit of computing. YC's HARC especially - harc.ycr.org

Bret's talk about their group's vision for computing - https://vimeo.com/115154289 - really helps people who think computing is "done" and all the interesting stuff is figured out.
Way Cooler: Customizable Tiling WM in Rust for Wayland with Lua Config
How's this different from sh or fabric?
I read a blog where someone got hacked through a simcard clone, and they went into the details of how easy it was to do. This prompted me to enable 2fa on everything I could, but the funny thing is, a lot of the backup options for 2fa is -- you guessed it -- your cell phone number. Some of them don't even allow you not to use your cell phone as a backup. I think Github and Slack are like this, but I may be wrong, it has been a while since I turned them on.
Nanoseconds... three months. I can handle that.
I'm SHOCKED this wasn't a thing earlier. Spoofing a phone number is insanely easy. When I was in High School we figured out how to do it and used to prank call people from other peoples numbers. Eventually, we realized that if you call someone's cell from their own number it takes you directly into the voicemail admin menu. Fun times.
Seems like there is lots of talk here about how this is thin wrapper over `subprocess`, but I like the idea. What I don't like is that the logo looks like a penis with a mustache.
It's end-to-end encryption, so the server code doesn't matter. You can compile it yourself if you like. Are you arguing that's no better than how Telegram is distributed?
A false dichotomy. Nobody is saying "wait till things are easy". Moreover there is always plenty of low hanging fruit that goes unseen for some reason or another, and I have seen and celebrate the many people go after those things and be wildly successful and world-changing.
You're acting like progress in science is inevitable just by sheer effort alone. If impractical efforts are self-funded I have no problem with them, but when they are sponsored by the taxpayer coffers I balk a little bit. Henry Markram's Human Brain Project is one effort where the technology clearly isn't there and EU money could be better spent on experiments using less sexy/flashy, but better established methods. This is not progress- this is regression.
I guess my code of ethics is independent of whether I "like" someone? It seems a little immature to be unable to acknowledge that someone was done wrong just because you don't like them for some reason. It's even more bizarre to assume that every investor in a taxi medallion must share the same perspective on the ethics of the industry as you do[1]. A lot of people just don't understand the details of the economic system they participate in, and deciding that that condemns them to being undeserving of sympathy is frankly more than a little disgusting. I thought my example of the role homeowners play in our economy would make this a lot clearer: I assume you wouldn't be so quick to "struggle to see what there is to like about" homeowners and decide that they deserve whatever economic injustice is wrought on them.

I can guarantee you there are plenty of things you do, from not worrying too much about the sweatshops you ultimately buy from to being complicit in the torture of millions of animals that many other people would consider unethical. Arguing that people don't deserve empathy if they aren't fully aware and fully conforming to your code of ethics isn't enlightened, it's just the same old gross "I want to be shitty to people I disagree with" under a thin veneer.

[1] FWIW, I agree with your assessment of how the industry works.
> "if men are 3x as likely to interrupt women" is literally an example of sexism.

no.
because men don't interrupt women 3x as likely
but it's sexism to assume they do just because you believe it's true
Is it really necessary or helpful to be rude to the poor CSR who is just trying to do their job?

They didn't make this policy, and I'm sure they think its just as stupid as you do.
Maybe not but in the desktop app world there is. It's called deterministic builds, where multiple people can build the same code and come up with the same exact binary. Gitian[1] is a popular one used by cryptocurrencies.

Basically multiple people independently sign the build so even if one is corrupted it would be difficult to corrupt them all (especially since an independent third party can replicate the results).

If there were an easy way to verify the hash of a binary on a mobile device, this could be an option.

[1] https://gitian.org/
Right. And while I generally dismiss conspiracy theories about the protocol itself (and have great respect for moxie), the one thing I find very curious is their staunch refusal to implement anything other than phone numbers as account identifiers.

There's absolutely no reason not to, and yet they refuse to do it.
Since we're here maybe I can ask you for clarification/help!

When I said "true statements that can't be proven" it should have been qualified to a particular set of axioms. That is, I am claiming each set of axioms has it's own set of true but unprovable statements but none have an empty set of those statements. Correct or not?

Based what you say about the second order axioms it seems not, in which case I have some reading to do :)
I've done development on these types of systems. I can't go into too much detail for obvious reasons, but your answer is yes. When the details of a transaction seem to be unusual or have an association with high risk or fraud, you'll get an email, sometimes a call, sometimes they'll immediately freeze your account.

It's a security measure to protect both the bank and the customer.
I have nothing constructive to add, except my fond memory of spending an evening with him in his madcap workshop, twenty (!) years ago. Crazy enough to dent the universe.
I'm just saying you are not a man because you are clearly pushing an agenda when you don't want to accept all the evidence that disprove your belief that men are worse than women in conversations

so you're just like my dog, you don't listen, bark and don't care if you're right or not

you just wanna bark for the sake of barking

and threats of ban are laughable

if they ban me, I can create another account

it's not really important what HN commenters thinks of me or what I write
The real answer is to not use SMS as a 2FA. That was never ever a good idea.
Inkscape Moves to GitLab
> The end user does not care if the driver is free software, they just want their machines to work.

Upstreaming the code also means quality control. Linus and his subsystem maintainers by far do not merge everything people throw at them. Users also gain out of the box support for their Hardware if the driver is in the kernel. Also a lot of people using and developing Linux or the surroundings care about (at least some aspects of) free Software.

> Why would it need to "reduce the quality of running kernels"?

Because possibly (mostly, HW manufacturers in general are not exactly known for the quality of their software) low quality code becomes part of the kernel, Linux is a monolith.

> If Windows can have a stable ABI, why can't Linux have it too?

I think not providing a stable API/ABI is a major reason why Linux is able to move so fast. If you have to make sure your change does not break this 5+ year old driver you can't do major architectural changes that easily. The kernel developers would then need write the equivalent of such a "silly" wrapper.

> I guess this is an issue for Google too, for their Linux fork Android.

Google apparently likes doing this, e.g. they also maintain a fork of openssl to make some minor changes for their needs.
Yes! A great contrapositive example is Peter Mitchell who believed so hard in the chemiosmotic effect and couldn't find public funding because nobody else could bring themselves to believe it. He had to find independent funding to start a lab and proved it using decidedly non-sexy/flashy methods. Eventually won a very well-deserved nobel prize.
More men in college sex assault cases are taking accusers to court
>> Find something you love because you might be doing it for the rest of your life. Passion is worth 10 index points. If you really love what you’re doing, it’s not work.

My bullshit detector went into an overdrive reading these lines.
This isn't a literal transcript of the conversation, more like what was going on in my head vs. what they said ;) Of course I was nice to them in explaining that I have a ton of virtual phone numbers and really don't know which one I used, etc.
Yes. It's not necessarily a problem, but it's a risk to consider carefully at licensing time.
This is the old security via obscurity. At least though, one should know that one publishes the full source.
> You can compute the present value of the total profit you can expect to earn

This isn't what we're talking about here. That's the equilibrium market price of the medallion, but the person I was responding to was saying that the overinflation due to supply restriction through gov't policy (i.e. medallions) was what was causing market value to diverge from "true" value. The fact that his goal is basically unreachable is sort of my point: his definition of "true" involves an ideal world in which taxis are optimally regulated.
It's actually dangerous.

Consider what would happen if you're accidentally exposed to a malware that steals data from the password managers (by introspecting process memory after the data was already decrypted)

Better keep those eggs in the different baskets (Update: Point was, I think 1Password doesn't have multiple databases, does it?)
A diagnosis may have helped him get medical care, which would have prevented his early death.

Diagnosis in and of itself is often welcomed by people with Autism. This is mentioned in all the English guidance (The Autism Act 2009, the Autism Act Statutory Guidance 2015; the NICE guidance 2012, the national strategy "Fulfilling and rewarding lives" and the newer national strategy "Think Autism") which all talks about the importance of diagnosis as a first step to understanding yourself and getting other people to accept you as you are.

Diagnosis is also an important step in getting services you need.
This is what somehow doesn't get mentioned as much as security. It's a tradeoff between not getting hacked, not getting locked out by accident, and convenience. If you get locked out of Gmail, you're up the creek. Google won't help. It's just gone forever.

Having 2 factors increases the chance that you'll lock yourself out. If you've got two, then you really need 4:

1) Password

2) 2FA

3) Backup codes for when you lose the 2FA device/number

4) Phone number or email address for password recovery when you forget your password. Not the same number as 2 of course.
The text is so chock-full of sports metaphors that I couldn't read to the end. I don't even know what half of those mean.
> Would you please not post unsubstantive comments to HN?

I take issue with this. How is the content unsubstantive? It wasn't untrue or misleading, it is just what the Stanford Binet IQ test classifies as genius. so that it being one becomes a matter of fact, not of opinion.

> At some point Cunningham's Law blends into trollery.

Now that I reread my comment, I see how it can be misconstrued as snarky. That was not at all the intention. It was meant to be self-deprecating and lighthearted, as I was using made-up words while criticize someone for not using made-up words. I thought about adding a smiley face so as to make my intentions clearer, but emoticons aren't really used on HN.

I'm about as anti-troll as you can get as I believe them to be parasites of the internet and a brief look at my comment history would elucidate than I am always if not I'm not earnest, helpful, or passionate in discussion, I am positive in tone.

Look at the amount of discussion it generated before being pruned and the varying opinions on what constitutes "genius". It's not that big a deal, but this is the first time I can ever recall having a comment moderated in my nearly 25 year history of using the internet. I see how it can be interpreted as snark, but when moderating, perhaps take the user's history into account.

For my part, I will make my intentions more obvious so that they will not be interpreted as negative or as an attack.
I don't know whether this is a great source on this topic, but Jared Diamond wrote an interesting article which expands on what you pointed out. "The Worst Mistake in the History of the Human Race" http://discovermagazine.com/1987/may/02-the-worst-mistake-in...
But it cannot include ",',$,;,<,space,etc.. because or engineers are still not 100% confident in our input sanitization.
Lichess also supports PNaCl Stockfish on Chrome for multithreaded analysis.
Does anyone know if Project Fi provides any extra layers of security? I haven't seen anything
Overall the etnaviv driver is young, both in mesa and in the linux kernel, so there are lots of nice-to-have features missing and fine-tuning.

Christian Gmeiner, Lucas Stach and Wladimir Van Der Laan would all be able to provide you with a more detailed answer.
Worth reading maybe?

http://reasoning.cs.ucla.edu/fetch.php?id=136&type=pdf

Abstract:

> We propose the Probabilistic Sentential Decision Diagram (PSDD): A complete and canonical representation of probability distributions defined over the models of a given propositional theory. Each parameter of a PSDD can be viewed as the (conditional) probability of making a decision in a corresponding Sentential Decision Diagram (SDD). The SDD itself is a recently proposed complete and canonical representation of propositional theories. We explore a number of interesting properties of PSDDs, including the independencies that underlie them. We show that the PSDD is a tractable representation. We further show how the parameters of a PSDD can be efficiently estimated, in closed form, from complete data. We empirically evaluate the quality of PSDDs learned from data, when we have knowledge, a priori, of the domain logical constraints.

Still working on my understanding but Professor Darwiche gave a lecture on the material in one of my classes. Salient bit:

> The problem we tackle here is that of developing a representation of probability distributions in the presence of massive, logical constraints. That is, given a propositional logic theory which represents domain constraints, our goal is to develop a representation that induces a unique probability distribution over the models of the given theory.
So, how much money did you lose if any?
Your observations strike me as all too accurate due to my own anecdotal experience. I've tasted both sides of the coin. After leaving a phase of torpor that lasted years and started taking life into my own hands, my mindset completely changed to the point where my past self feels almost alien. The effect nostalgia had on my daily life essentially went from a driving force to a non-factor.
You'll see the same trends in software. The healthy greenfield projects and disruptive startups share cultures of competitive individuals united by a greater fight, but the real challenge is adapting the culture to slower growth or steady-state maintenance... the faster the change the harder it gets.

America's is a young nation that has been constantly growing and fighting for much of hour history, we have never sat still for long enough to develop a more mature unifying ethos. Our culture is crumbling because it's at odds with the world we now live in.
I feel like whenever possible, the answer is to stop storing sensitive information in source control. That solves a whole class of problems, including this one.

If your history has sensitive info, see about rewriting the history. If that's not possible, maybe fork the repo, remove the sensitive info, and get the team to switch to the fork. If that's not possible either, make the sensitive info meaningless (reset your DB passwork, revoke the API tokens, etc).
It would but the average user would be pissed if they went into a retail store and were told that they had to wait weeks to use their new phone. They might decide to abort the purchase.
Let's say you pre-render the DOM nodes on the server. At that point, there's no need to create them again in the browser from the JSON object. How would you augment them to become Cells?
> Sexism IS a biological tendency

not at all

sexism is behaviour

sexism is believing that women cannot do something because women are inferior by design, not thinking that they are generally weaker (biologically true) and it's probably best if it's the man who carries the heavier luggage
Dude, what are you talking about? I don't disagree with any of your bullet points.

I like Uber, I'm a heavy user, and I'm glad they exist. None of that changes the fact that the gov't had bad policy for twenty years and then screwed over the people who decided to operate within the policy regime. I've provided ample examples above: you can't decide that every taxi operator and medallion-holder deserves getting screwed by dishonest gov't without deciding that the same is true of every doctor and homeowner in the country. Hell, you'd be hard-pressed to find an industry _is_ run fully optimally, so you're basically throwing the entire concept of a stable regulatory environment out the window, which is just ludicrous.
So 2FA reset via SMS is bad, which I agree but what are the alternatives to prevent a meltdown when your 2FA device dies?

I have had two phones die on me that was my 2FA device, plus OS upgrades, so I have gone through resetting 10-20 2FA accounts a few times. Though with upgrades usually I foresaw that and downgraded my 2FA before hand.

All I wish for was that resetting 2FA would be a very very slow step by step process and spammingly broadcasted to all emails, sms, postal etc associated with the account. But I know for cost cutting customer services departments that wont happen.
The direct URL is https://www.paypal.com/us/cgi-bin/webscr?cmd=_setup-security... , it's no longer accessible from their new web interface.
Okay it looks like they are planning to get the origin right eventually by working with browser makers. Good news!
Sadly nothing here seems to be a console mover for a One X.
All the games are backwards compatible, really boils down to do you want to pay more for 4k? I would imagine many of the titles that are play anywhere are better suited on pc anywy (Looking at you crackdown 3).
"Where do people with an urgent health problem on a weekend go outside of the US?"

UK: We have several options. If it is non urgent then ring 111. If it is really urgent ring 999 and ask for an ambulance. If you can, then get yourself to the nearest Accident and Emergency (A&E) dept.

None of these options will involve a credit check.

For example I had a wisdom tooth snag a few years back on a Sunday morning (it hurt quite a lot.) I rang 111 and within about 1.5 hours (including 1 hour drive across Somerset) I had it removed. The NHS isn't perfect but sometimes it feels like it. I have several other anecdotes that are less complimentary about it and some other good ones but in general I'm a major fan.
The issue I have with 2FA without sms is that I need to also take care of recovery codes. Basically, it's like erasing all the benefits of going digital, since now I have to store (and take care of) paper copies of recovery codes.

If I use a 2FA app like the Google one and lose my phone, I need to have the codes ready. If I were to use my phone number, I kind of don't need that since I just get a new sim and a new phone. But at the same time that is not safe now.

So what is the solution here? I liked the idea of something like DUO but not enough places use it.
David Gerard vs. the blockchain, an emerging wiki war
With GitHub the SMS backup option is just a secondary choice, not required.

A UbiKey or similar device or just storing the recovery codes + using an app is the best route in that one.
None. I find reading much more efficient.
I use 2FA code generator in cloud-synced 1Password. That endures all software upgrades, unlike Google Authenticator or Authy.
To me the current political debate in the US is just manufactured theater to keep the people busy arguing about unimportant things. No real issues are being discussed, no path forward for the country. It's just "You are bad. No, YOU are bad". I have no idea what the Democrats stand for otherwise than maintaining the status quo and the Republicans just want to make sure that the upper class gets richer. And the electoral system doesn't allow anyone with new ideas to come up.