skysight-inc/HackerNews huggingface dataset:
Horror Vacui, the Fear of White Space (UX Alphabet Series)
Do you have an recovery scenario in case you'd actually need those?

I was almost there once. Authenticator device had died, and to my horror the primary backup was corrupt as well. I had a secondary backup (and even an off-site tertiary one, although it's somewhat dated), so I was able to recover... But I also had the idea that I won't ever have to use recovery processes and even though I hadn't, after the incident my certainty it's not so iron-clad.
You could try Authy. The restore is not immediate but it keeps track of the services you have set up for 2FA. Trusting a huge honeypot like that with your auth is up for debate.
While conversation is probably not a good example of anything, I agree with the main statement: phone numbers must die. They are insecure, unremarkable remnants of an outdated system.
So true! We have thousands of employees at our company using GitHub.com, and every week someone loses access to their account permanently. Why? They never bothered to store the original recovery codes for the account.
If anything the ability to get texts via the web makes it worse.
I don't like the advice he gives on just denying access to .git. I think the idea of cloning the repo in the htdocs folder is just wrong.

A much better approach (or at least, what I use) would be to set up the repo somewhere private with --bare and set a receive hook to checkout HEAD to the htdocs folder, this way the htdocs only has the content and you get the extra feature that you can sneak extra commands on the checked out source (such as building/minifying) without changing the original source
Reddit’s origin in a conversation about Delicious
I would not think CSR would actually know that phone is not a secure channel. I bet they are taught it is.
Tony Awards Live Stream [pdf]
John Oliver is wrong about a lot of things. His show is too inconsistent for me, sometimes it's really sloppy.
You should also make sure providers like Google don't fall back to less secure account recovery methods. I blogged about this here, after I realized that I was still vulnerable even while using real 2FA:

https://ericrafaloff.com/google-account-security-and-number-...
>Who is working on better routing protocols?

Scion is a clean slate internet architecture research design (including routing)[0].

>It seems like bgpsec is about as good as we are going to get.

I was author on a paper [1] that reduced some of the downsides to the RPKI (the PKI BGPSEC relies on).

There is also interesting work on getting most of the security from BGPSEC without complete BGPSEC deployment [2].

In a different direction, as we build the internet of the inner solar system we will need protocols with different properties than those we needed for terrestrial networks.

[0]: https://www.scion-architecture.net/

[1]: "From the Consent of the Routed: Improving the Transparency of the RPKI" http://cs-people.bu.edu/heilman/sigRPKI_full.pdf

[2]: "Jumpstarting BGP Security with Path-End Validation" http://dl.acm.org/citation.cfm?id=2934883&dl=ACM&coll=DL&CFI...
Most major providers like GitHub, Google etc allow you to create "recovery" codes - so you can do a one-off login without 2FA using the code.

I've started getting a recovery code for each of my major accounts, printing it out, then literally putting it in a safe.
Check fiverr.com also. Saves you the trip to Russia :-)
I do!

See also:

https://vimeo.com/131396094

https://twitter.com/stevedombek?lang=en

Also, https://www.amazon.com/Nature-Economies-Jane-Jacobs/dp/03757...
As a life long science fiction reader, I feel the "arcology" concept has been imagined for a long time in many different ways. I think the idea is inevitable, although probably more Caves of Steel than Trantor. And hopefully not Judge Dredd.
Lots of discussion on /r/rust: https://www.reddit.com/r/rust/comments/6gavfe/how_mutexguard...
Well, 80% of my users are US based, and I kind of doubt the EU can't do anything to me in the US.
> If I use a 2FA app like the Google one and lose my phone, I need to have the codes ready.

It is a trade off. You either want difficult access if you lose your phone (via printouts) - or you want quick access (via SMS).

I dont think you can realistically have it both ways.

Having a "slow" method to retrieve a major access to your accounts seems to be the safest method, especially when you are likely to rarely use your phone.

You could also give a copy of the printouts to a family member or close friend, who you could ring if you were remote.
Is there any senior leadership left at Uber?
It's indeed very interesting!

What I meant is that it might be simpler to just have pure functions operating on immutable data structures, which you could then compose in whichever you want. I.e. you could have a function collapse-vertices that takes some geometry and produces some new geometry (without altering the initial one!), which you could then compose with some other pure function, like produce-random-vertices, and so on, much like a Unix pipe.

A free monad is just a formalization of the command/interpreter pattern in a purely functional context (i.e. most useful in languages like Haskell or Clojure).
Introducing support for over 9,000 banks in the U.S. and around the world
Isn't this a non issue (don't need to change any config to block .git) with a properly configured firewall and nginx proxy passing to localhost when the code does not live in a publicly visible location? Eg- https://www.digitalocean.com/community/tutorials/how-to-set-...
At my first job, my boss, who was in his seventies at the time, told me that once people get to a certain age, societal expectations of sharpness decrease rapidly. According to him, this led to many people eagerly taking up the mindset you describe.

Maybe your peers never really had the personal standards you thought they had in the first place, and simply stopped trying once the peer pressure eased up and they got a good excuse to lay around?

This type of pressure is often met with scorn as something we are too good for. In my case however, it really helped me become a better version of myself over time.
Show HN: Writing XPath expressions using native Python syntax
What do you think is the best hand-solderable application processor these days? I don't see any non-BGA I.MX6 chips, but I didn't look very hard. Is the hobbyist stuck with an ARM926?

Also, in that vein, is there a similar solution for I.MX23's?
It's not a claim that things would never happen but that it'd take much longer. Yes, private investment exists but it's so much smaller — MIT is legendary, one of the top schools in the world, has a full-time development office getting donations, etc. but the bulk of their research is federal by a large margin.

I note that you dismiss the foundational technologies of the last century as cherry-picking but fail to present any data to support claims which are well outside the mainstream. Do you have any sources to back those assertions up?
That's especially fun for me when my phone syncs with my car's handsfree setup. I wind up with all my FB entries (which have no phone #'s attached) mixed in with all the deliberate entries which do have phone #'s. I wind up having to scroll thru 150 or so extra entries on the radio screen just to make a phone call in traffic.
I find it interesting you say 75% when zero of the Apps I use integrate with either Facebook or Twitter. Now I am kind of curious which of us is closer to the norm.
Usability. As soon as you install Signal you can message all your friends (whether they have Signal or not), because you already have their phone numbers.

This feature is possibly the most important reason that Signal has seen widespread adoption in average-user land.

Signal makes a lot of decisions for you, which enrages nerds but is actually pretty appealing to everyone else.
GS1 Barcode Processing and Improved QR Coded Barcode Recognition Using Java
What are you talking about? At all (german) companies I ever worked at is was common to request a "Polizeiliches Führungszeugnis" (essentially police records or the lack of such) first thing during the trial period. This is absolutely common, maybe you just forgot about that?
Recruiters do reach out to people but HN front page is a bad way to get attention.

First, you have no control over that. Second, it only lasts for a day.

The right way to do it is to build long-term credibility by:

- having a personal website (https://blog.kowalczyk.info/) with basic information about you , your up-to-date resume (e.g. https://blog.kowalczyk.info/static/resume.html) and a way to contact you (e.g. https://blog.kowalczyk.info/contactme.html)

- blogging on deeply technical topics. Avoid rants and anything that is not about technology. The "deeper" the topic, the better. (note that my older posts can be ranty; newer are not).

- do interesting, open-source projects. Have them on GitHub. On your website, create a "portfolio" section that summarizes the projects (https://blog.kowalczyk.info/software/ but it's far from the best portfolio design)

- for inbound recruiter requests have linkedin profile. The quality will be lower than those who contact you via website, but it's easy to ignore bad recruitment pitches

I do get contacted by recruiters. It resulted in one job and I do believe that portfolio of projects helps me when interviewing.

This is a very long-term strategy. My website is 10+ years of accumulated work.

In the short term, on 1st of every month HN has "Who's hiring thread". Apply for jobs listed there or in other high-quality places like https://stackoverflow.com/jobs
studies in US generally say yes

We all know US men are generally terrible...
It's a turban, jeez.
Two thoughts here.

If you look at fingerprints or the spongy interior of bones, clearly there's a lot of detail there. But the position of every skin whorl or bone void is not specified directly by a gene. Identical twins don't have identical fingerprints. This doesn't matter for finger or bone functionality, as long as the material works on a statistical, higher level. If you think of it as a blueprint for a bone, like for a building, the specification just says "x percentage of void with average cell size y and variance z", just like a building specification doesn't specify the location of every grain of sand.

And of course then it also grows in response to how it's stressed. Anyway, this is because it wouldn't make sense to store all the exact information, you just store some metadata and generate the actual stuff when building. Also you do testing and build more after that.

With the brain, it's the same, the amount of neurons and synapses is large compared to the amount of genes or "blueprints". But in a brain, as opposed to a bone or a finger, because the whole thing is designed to amplify weak signals, detail differences can have more effect on the function of the whole. There is this whole internal testing pattern going on while the brain is being built, but it seems it's not so perfect that clear differences creep in easily.
I would expect greater risk if I spread that information around more. Is it really better if only 1/3rd of my passwords are stolen, at least relative to the 3x risk I face by using multiple sources?
I've found most apps were using the website login flow instead. Which used to annoy me but I assume it's because many are using cross platform frameworks.
Fire on the Mountain: The Gatlinburg Wildfires
OAuth is a family of RFCs, including 6749, 6750, and others. While 6749 is the minimum for OAuth2, in the specific case of the three largest providers under discussion, many other extension specs have been implemented. The OpenID connect logout spec has become the de facto logout spec for OAuth (as the OAuth RFC makes no mention of logout). All three providers mentioned implement it as the primary logout mechanism on the web.

Spec: http://openid.net/specs/openid-connect-frontchannel-1_0.htm

Edit: I should say, this spec also doesn't require cookies - you can use HTML5 local storage or another mechanism. In practice however, if you log into a Google service like YouTube, or a Microsoft service like Outlook, or a Facebook third party like Spotify, they use cookies.
The greatest sports achievement in my lifetime?
I apologize in advance if I'm being overly pedantic, this weekend I took the time to do a cursory study of chaotic complex, systems emergence and fractals and i'm still trying on this new knowledge, but is it really considered random? (I dont know the precise definition)

Even if raised in identical conditions, a small perturbation in a social interaction (say one od the fish is looking directly at an event whilr another only catches a glance at it from the side) can bubble up to produce large changes in behavior?
Years ago, when SMS 2FA first became a thing, I remember people familiar with telecom stuff pointing out SS7 vulnerabilities and porting/SIM takeover issues. People shouted them down and claimed that they were being too paranoid and exaggerating the risk, or that most people aren't attractive-enough targets for someone to dedicate so much effort for hacking their accounts (and that SMS 2FA was thus good enough for most people).
Just do it.

We can't predict the future and execution matters.

When in doubt, be biased toward the action.

The more things you do, the more likely you are to succeed.
I've just put it on my list to read the Python source.
Remembering Mr. Rogers, a true-life 'helper' when the world still needs one
How to Use Quipist to Boost Blog Traffic
Thanks, I assumed so but I wasn't sure.
Good luck shooting at an Apache helicopter with a mounted minigun with your semi-automatic gun.
Only true if the distribution of people going to a stadium is not biased to below average intelligent people, or biased in some other way, which I suspect might be the case.
Best ratio of Comedy:Operating System that I could have ever imagined.
This happened to me in the 90's so not sure how possible it is today. Someone got hold of my account number - I think it was in Las Vegas when I used an ATM and didn't get the receipt, then when I realized it a couple of minutes later, walked up to get it and didn't find it. A month later at home in Austin, my ATM card was declined at the bank ATM and I was baffled because I knew I had enough money for the transaction. When I went into the branch for an explanation they told me that I had no money in my account because earlier that day someone of a different gender and race ( they had video) had used 12 different bank branches in a different city (Houston) to withdraw 2000 at a time via check. I had to a sign something that swore that I did not do that and the act was not connected to me before they would restore the stolen funds to my checking account.
Source Code is the sensitive information that he's talking about in the article.
If the .git folder is exposed, you can download it, then do "git checkout" in that folder and get the full working copy.
You can emulate a poor man's version of this by continuously trying new and challenging things.
Haha! It does, doesn't it! Once you see it, you can't unsee it!
“derisked” is [willful?] misrepresentation. This isn't a hard argument: board early research requires a lot of speculative work which doesn't pan out for everything which does, not to mention tons of basic training and equipment investment. Companies have a hard time justifying that and, unsurprisingly, the record shows they largely don't. Government funding operates with different incentives and timescales and has a lengthy track record of success getting ideas to the point where companies are willing to foot the remaining development costs.
In a way neither the past nor the future exist. There is only the present.
You can get a i.MX6 SoM (system-on-module) to take care of nasty things like external memory.

https://www.solid-run.com/freescale-imx6-family/imx6-som/
isn't it old article ?
Last year when I upgraded my phone I was amused — but mostly horrified — by how easily one could get a SIM card for my own phone number with less than a modicum of information on me.

As I required to upgrade my Micro SIM to a Nano SIM, I went to one of my provider's shops and asked for a Nano SIM for phone number X. I was then asked to verbally confirm my name and address — and that's it. No ID card confirmation, no nothing. "Here you go sir, your new SIM card will be active within a few minutes. Can I help you with anything else?". What. the.
Old article ?
The first python snippet was meant to be identical to the Go one and the Go one is the one from the article.

> With Python, you can write the exact same code that asks for the same mental gymnastics.

The second Python snippet would idiomatically be written on one line and that's what the article is railing against for unclear reasons.

The comments would not appear in source code, they're supposed to illustrate the thought process of the reader as they encounter the source code.
15 Scrum Concepts for Beginners
> grep "^$1," database | sed -e "s/^$1,//" | tail -n 1

FWIW.

Shell pipelines are very useful, but sometimes, you don't need them.

Case in point:
- sed can do the matching:

sed -n -e "/^$1,/s/^$1,//p" | tail -1

- sed can just take the last match:

sed -n -e "/^$1,/h;\${g;s/^$1,//p}"

- sed can be cryptic, so you might prefer awk:

awk -F, '$1 == "'"$1"'" { val=$2 } END { print val }'

although the fact that it's in a shell function makes the "'"$1"'" thing kind of confusing. It would be less confusing if using a named environment variable...

maybe less bad with explicit escapes...

awk -F, "\$1 == \"$1\" { val=\$2 } END { print val }"
I'm hardly an electronics designer (although I do it for fun), so I don't have much of an opinion.

However, I don't think there are any SOCs with Adreno or Vivante GPUs that are also hand solderable.
A quick Octopart search[1] turned up nothing.

About iMX23, a quick look seems to suggest that it has no 2D/3D capable IP on the SOC. So it likely just has a display controller of some sort. Unfortunately I don't know what that display controller is. It may be encompassed by the imx driver depending on that the hardware actually is.

[1] https://octopart.com/search?q=&start=0&category_ids=4267&spe...
Although the technically mean the same thing, the feelings they evoke are quite different
Regarding the $8k of bitcoin stolen (https://medium.com/@CodyBrown/how-to-lose-8k-worth-of-bitcoi...), that's what you get for storing your coin in Coinbase or someone else's service. If you're not in control of your keys, you don't own the coins. This uncomfortable truth has a way of occasionally poking out, like that story.
It seems this was a popular hack at one time. I hope this no longer happens. Anyway it's great that you were able to "shake it off", so to speak.
I think you should go back to reddit or 4chan or something
If you post your source code to github you know it will be public, and might remember to remove passwords from debug code etc., however if you expect it to be private, while it's not, you might be lazy and store passwords in plaintext in the code. A horrible thought for a programmer, yes, but human beings are lazy.
QM effects are considered random and influence just about every real world system.

PS: At the 'other end' relativity actually influences a lot of chemistry because electrons are just that fast in orbit around atoms. But, that's generally ignored by just about everyone. https://en.wikipedia.org/wiki/Relativistic_quantum_chemistry
TIL. Thank you.
Do you include Python 3.5's subprocess.run in that assessment? I find it much cleaner for the common cases than the rest of the API:

https://docs.python.org/3/library/subprocess.html#using-the-...
You're right, sorry, I remember reading about it BBC and was sure it was one of the MPs. It was not.
Totally. There are multiple known soundness issues with rust already. Still, the language is definitely miles ahead when it comes to safety (within its niche).
I always answer security questions with a known grammatical transformation of the question's sentence structure. That way, as long as they use the same parts of speech in the question to prompt me, I'll never forget an answer or have it guessed by an attacker.
I am not biologist (that is the following is pure speculation based on ignorance) but it feels to me that the method of their cloning leaves in opportunity of minute changes in the offspring DNA.

This then still leaves open possibility that different behaviour is cause by genetic mutations but this variation it much more amplified that presumed previously.

I would be happy if somebody with more knowledge finds time to comment on this.
But...if a public that doesn't understand the nature of backdoors is fearful of the consequences of backdoors being cracked, it's a short step to turn attempts to crack the backdoor into something terrifying, in which case an attempt to crack the backdoor becomes a justification for its existence.

Yes, I'm cynical on this matter.
Failing to build VirtualBox on Windows
The article is a giant strawman. Net Neutrality is currently a joke, the push by the insane xenomorph clown-toothed Pai Verizon lawyer head of the FCC is to merely inculcate corporatism as officially-sanctioned. With fewer internet protections, there is a slippery-slope for Western countries to allow increased blocking, throttling and censoring of sites much like closed and authoritarian-ruled countries like China and Turkey.
Not in those words obviously, but yes I have had numerous calls from credit card issuers during or after a large transaction. ATM cards or bank credit cards are usually tied to a bigger card issuer. These issuers have a lot of fraud prevention systems in place.
Museum of Failure celebrates products that flopped
Farms in the first world still do this.
Until a website thinks a 1 is an lower case L, and you have the same problem all over again.
>>Not in the "Ugh, fuckers" way, but in the "God damn it if I knew then what I know now or at least listened to the people who did know, I could be that ultra successful young hotshot! I had all the opportunities and I didn't take them for various reasons. Grargh!"

Eh, the types of success we envy is mostly a matter of luck. Being born to a family with means and connections, being good-looking, being at the right place at the right time, etc.

Obviously if you actually knew back then what you know today, you would buy lots of bitcoin and Tessa stock. But in terms of "soft" knowledge, I'd say you would probably end up in a similar place.
I do some OSS development for UDOO, which sells iMX6 SBC (6Q, 6D, 6SX). We currently offer Android 6, I started to build 7.1 a few days ago.
Intro end, question is, did you compare the performance between Vivante and OSS stuff?
Hey, thanks :)
Yet nobody else had landed and reused the first stage of a rocket. They are doing truly novel things.