skysight-inc/HackerNews huggingface dataset:
I have a few concerns about the cryptosystem.

First of all, there does not appear to be a whitepaper available that describes the security architecture in any detail. This is an immediate red flag.

Second, they do have a "Security Features" page which is rather light on the details; it mentions that ProtonVPN uses AES-256 (encryption), RSA 2048 (key exchange) and HMAC-SHA256 (auth).

I'll start with RSA: the fact that they use RSA at all for a new cryptosystem in 2017 is a red flag for me. I also can't see any details of how they use RSA, so I don't know if they have implemented padding. If they haven't implemented padding (and done so correctly!), the VPN is insecure and we can stop right here. Honestly, they should be using ECC. I'm assuming they're not using something like ECDSA because RSA is faster (but not so much so to justify the potential security tradeoff, even in a VPN client).

On to AES: they commit the common marketing-mandated-security-page sin of focusing on the key size instead of the block cipher mode. They don't explain which block cipher mode they're using for AES at all - another red flag. For all I know they're using ECB (in which case, the VPN is insecure and we can stop right here). This is putting aside the question of whether or not they correctly implemented AES in whatever mode they're using.

With regards to HMAC-SHA256: in theory this is fine, but again we have no details. I'm going to go ahead and dock another point here because they're choosing to use separate primitives for encryption and authentication, when the best practice would be to use authenticated encryption like AES-GCM or AES-CCM. I admit this is bikeshedding a bit: respectable cryptographers (like cperciva) have a preference for separate construction. However, this is a VPN we're talking about, and an authenticated encryption mode would be faster than separate encryption and authentication.

A few caveats to my points: I'm quarterbacking their cryptosystem design based on one paragraph of the security page, because that's all I can find that describes their crypto. It doesn't describe it in detail, so it might still be secure. I have no knowledge of their implementation, so I can't critique that. That said, if I had to weigh the red flags I've observed here against their "developed by scientists from MIT and CERN" marketing and nothing else, the red flags win out.
I use imgur for work sometimes, and this throws my team off every time.
Hi, "surtitles" are subtitles shown in theatre shows and opera. Its key goal is to increase accessibility of performances, mainly for foreign speakers and visitors with reduced hearing. This app not only resolves the pain of creating and translating surtitles, but also allows screen subtitles (also) into mobile devices. Screening to projection can be adjusted in multiple different ways (colors, fonts, positions, ...).

Main competitive solution now is PowerPoint.

I'd be glad for your suggestions and recommendations. Thanks! ;]
also if you accidentally hit the left or right arrow (which i have an unfortunate habit of doing when on a website, it's sorta part of my idle animation).
Wow, didn't remember how inconsistent the Linux coding style is. Or all C basically.
The difference between these (good) examples on HN

https://news.ycombinator.com/item?id=8499305
https://news.ycombinator.com/item?id=11887147

And your so-called good behavior in hn is; you show no substance whereas they provide something to start hacking.

Perhaps this helps?
You can search/filter by certain keywords, but I have those filtering options (price, subscribers) on my to-do list. Hopefully it'll be ready later this week.
I laughed.

But then I thought about the users who don't know any better and might stumble onto this site. They aren't stupid. They just don't know any better, and a lot of education attempts can go over their heads. Worse yet, sites with poor password policies (seemingly every online banking site in existence, workplaces, sites with 16 character maximums, etc.) reinforce bad practices in their minds, while attempts at explaining the problems are forgotten. I'd probably explicitly note that it's a joke, especially if someone tries to copy the password. :)
The High-Tech Device That’s Like a Bouncer for Mosquitoes
"having worked quite a few years with strong type systems, weak type systems and dynamic type systems"

Sorry to be pedantic, but you probably mean static type systems, not strong type systems.

See: "What to know before debating type systems" - http://blogs.perl.org/users/ovid/2010/08/what-to-know-before...
I'd rather append 0A! to passphrases to satisfy silly requirements instead of capitalizing Every Single Word (impossible to type at speed) and inserting a symbol at a random place. This looks a little troubador-sy.
This tabs vs spaces thing is a recurring joke and source of conflict on HBO's Silicon Valley, and I always thought having a raging debate over tabs and spaces was one of the less realistic things about the show. But what I'm hearing now is that my use of emacs has just left me out of touch with the really tedious stuff other people sometimes have to deal with.
Wait. Do you mean they actually inspect traffic and tear down the connection if they see an SSH handshake on any port other than tcp/22?
At that point they're getting negative value out of tabs - people can't set different tab widths and also can't use editors that don't use a width of 8 (or need to reconfigure editors that have a different default). They'd be better off just using spaces.
"Your password must contain 1 capital, 1 small letter, 1 number, 1 symbol, 1 Cyrillic character, 1 Kanji, 1 half-tone, and 1 boson."
A lot of jobs in the US pay biweekly, which comes out to a nice, round 2.166 paychecks per average calendar month. Paperwork here generally either asks for annual income or asks both paycheck and length of pay period.
Bear in mind that Amazon already has all the pieces in place to offer ML-driven recommendations, and I would be surprised if it didn't offer that option once this gets out of beta.

It's possible ML-driven recommendations may surpass the recommendations of StitchFix's "personal stylists" in terms of accuracy. And unless "personal stylists" is just a market-facing name for "algorithms," ML-driven recommendations by Amazon would certainly surpass StitchFix in terms of efficiency and operating costs.
That quote reminds me of one of Joseph Campbell's - "computers are like Old Testament gods; lots of rules and no mercy."

And to go along with that, some things like GNU Make still requires tabs, which is definitely annoying when you have your editor set to autoconvert. And some sects like Go or Python don't technically REQUIRE one or the other, but still try to aggressively purge the heretics.
In the UK we talk about annual salary.
it seems reasonable that it didn't allow it before the language designers explicitly created a flag for it.

That doesn't mean some enterprising soul wasn't able to make it work, but it does mean it wasn't officially supported.
I don't think kotlin is TypeScript. Kotlin adds to java some nice things like coroutines, it is not only null safetly, functional programming and some sintax sugar. And also compiles to javascript and in the future to native.
The law firm Cooley is updating its packet of startup tips and financing documen
Baby steps to prove the concept before scaling up — crawl before walking, walk before running. Even for Google.
That is still better than the giant animated cat paw they had a year ago. It was active just before reddit went live with their image service and I imagine it was a desperate grab for some last minute conversions.

https://www.reddit.com/r/IgnorantImgur/comments/4aqf2r/fuck_...
Neat brother. +1 = A109
Ten Weeks with Y Combinator’s Startup School
Varjo promises a VR headset with 'human eye-resolution'
> Looking at that stack, it seems like someone in your organisation likes sticking plasters over problems.

glad to see I'm not the only one that got that from the post.
There's just no way to do a free image hosting site without it turning to crap sooner or later. When Imgur started making it hard to copy the direct .jpg links, it was game over.

What's interesting is that Imgur managed to pivot into a full-blown community site, with threads, communities and voting. I don't think they're very dependent on Reddit anymore. From a few cursory glances, they have a relatively large amount of participation, and it's not unusual that an image shared on Reddit has a huge comment section on Imgur, with Imgur users not getting the context (that of course is over on Reddit).

Reddit is doing a smart thing here by hosting the images themselves. They're now at a scale where hosting images is feasible. Being dependent of Imgur (and Imgur not being dependent of Reddit) is a bad thing for Reddit, since most of the popular content on Reddit is images, and so Reddit gives away a huge amount of traffic to Imgur (which is basically a Reddit competitor now), trading that for the expenses of running an image hosting site. I guess Reddit realized it wasn't worth it.
I still find "long-range" electric vehicles to be an oxymoron. A Bolt @ 75 mph can only make it 190 miles. I'm not sure that is enough to get me to a qualified mechanic and back and it sure doesn't compare to the nearly 500+ miles I get on fuel. I can't afford to drop $30,000 on a car that I can't take on a road trip.

I think the progress made on electric cars is exciting to watch, but I have to laugh when they talk about "long-range".

http://insideevs.com/instrumented-test-of-chevrolet-bolt-190...
>Parasites can offer a beneficial service to the host but cannot live without it.

Incidentally, this is not what biologists consider parasitism. To a biologist, a parasitic relationship is one that benefits one while harming the other. Do you think that reddit was harmed by imgur? If imgur benefited but reddit was not harmed, their relationship was commensal. If they both benefited, their relationship was mutual.

To capture the idea that imgur was totally dependent on its relationship with reddit (but not vice versa), you would say that their mutualism was obligate for imgur but facultative for reddit.
Down the SSH_AUTH_SOCK Rabbit Hole: A Gnome Adventure
I think there are truly private class members in Python, prefix the name with `__`.
> Done. In addition, the email listed on https://github.com/A9T9 also reaches me.

Neat! Brother. +1 =100 Ace
AIDA64 Extreme Edition 5.92.4300 Crack Is Here
> Those are ignored by the Python bytecode compiler though

That's the whole point.

> you may as well just reach for TypeScript instead of Python.

The only reason I do JS is because it's the only browser native language we got. I'm never gona use this aweful tech anywhere else if I can.
I wonder if the end goal here is for Google to start selling "Promoted Jobs" advertisements.

I'm also a little concerned if this gets popular that competitors jobs will happen to be further down the list than they should be, but that's probably just my paranoia.
They should. For their parents.
Gravitational wave mission selected, planet-hunting mission moves forward
I was under the impression that ASICs were far better for mining. Have GPUs caught up again?
How is virtualenv not always available?

```
pip install virtualenv

virtualenv -p python3 venv
```

If you have a heavily locked-down server or something, talk to the administrator.

> updating a certificate should not require a large amount of software to be installed on the sly on a machine, it should just upgrade the certificate and be done with it.

I respectfully disagree. First, updating a certificate can be done by hand without the use of any software. The point of letsencrypt is to automate the process. Automation requires software. If letsencrypt were written in C you would still need to ensure that the executable was compiled for your architecture and that you have the correct header files available in the correct locations.

I'm also not sure what you mean by "on the sly" here either. If we assume that you mean that the letsencrypt package automatically creates a virtualenv, how is this any different from postgres installing libxml2 as a dependency for example?
Even if this site was not a joke, I wouldn't trust an online password generator, especially if the pass is generated on the backend instead of the client. A quick Google for 'password generator' yields hundreds of these sites which are more than likely run by the same outfit and are possibly logging the passes into a database to make cracking various accounts easier.

There's a few PW generators which run on the client only and don't send any requests to third parties, and I use them sometimes. They are typically very JS heavy and use different seeds to generate sufficient entropy, like client fingerprint, mouse co-ordinates, timezone, etc
Not to mention the sour smell that clothes get when left wet for too long in the washing machine.
By ~somewhere~ you mean like LinkedIn?
Is there an equivalent to "every program expands to read email" for web services? Because just about every image hosting service seems to go down this feature creep route.
I feel like Apple's target market should be selling solid computer devices that can fetch a high markup and further a brand of exquisite form/functionality, but they have been away from that in favor of a "squeezing-the-walled-garden" model lately, huh?
Supersonic flight promised by 2023 as Boom announces airline orders
Previous discussion: https://news.ycombinator.com/item?id=14577828.
Honestly I've been avoiding this conversation for the last week, but it seems the right time to bring it up: tabs are content.

Spaces are content.

They are both part of the SET.

Everybody, just give it up. They have their users. They have their uses.

(:set shiftwidth=4;noexpandtab)
There are two reasons why I disagree that `with` shouldn't be a function. The first is evaluation order; the proposed function form has will leak resources if the latter argument's expression raises, that is, in:

with(obtain_resource(), make_function_to_process_resource())

if `make_function_to_process_resource` raises, we leak the resource. You can, of course, pass a function as the first argument to fix this…

with(lambda: obtain_resource(), make_function_to_process_resource())

and we're good again, but I think this is why the syntax is nice. It's sugar.

The other problem would be lexical scoping:

with(lambda: open('foo'), |fobj|:
data = fobj.read() # data is bound to the wrong scope!
)

Assuming we're ignoring Python 2, we can work around that,

data = None
with(lambda: open('foo'), |fobj|:
nonlocal data
data = fobj.read() # data is bound to the wrong scope!
)

The sugar gets sweeter.

(I suppose we could also copy how Ruby does scoping/binding, since we're copying syntax. I also think this is why a let keyword is nice.)

I don't think the above arguments invalidate his general argument for a better multi-line lambda syntax, just the argument for with-as-a-function. (Though he was using that to support multi-line lambdas as a potential use-case, and I don't think that's really the case.) I'm just not as bothered by having to def a function, in practice…
I feel this guy.

But I still live with it.

But damn do I feeel you.

....
> On the other hand, if my editor has to incorporate a full-blown parser for your program's (meta)language in order for me to find where something's defined, then maybe your program needs refactored more than my editor needs replaced.

Either you want your editor aware of your language's semantics if you don't. I rather do, because it saves a ton of time and basic integrations are usually quite straightforward in 2017.

> Or perhaps better documentation on your program's part and/or better education/familiarization on my part is warranted.

Barring my opinions on this, I don't get why this would exclude editor semantics.

> Most modern editors are able to horizontally scroll and thus handle long lines in source code. That doesn't make a 500-character-long line of code acceptable by any stretch.

Okay, but this is a false equivalence. You're telling me not to use metaprogramming tools because they make it hard for a specific editor feature to be used in conjunction with them in the most difficult case for any system (introducing new run-time-dependent lexical bindings into a scoped block and handling that at compile time).

But unlike code visibility, in most good solutions exist to work with these systems (within reason).
Good to know. Am in the throes of choosing between both for a simple project
>There is no easy answer to this question.

Of course there is. You comply with both laws or suffer the consequences. If you can't comply with both, you choose the cheaper law to break. If that's too expensive, your business sucks.
Based on my own experience, the large majority of students looking for industry jobs (including myself) will apply to many jobs without even hearing back. To read about people complaining about being recruited is the complete opposite of our problem.
Here's a good comparison list: https://thatoneprivacysite.net/simple-vpn-comparison-chart/
Quite likely. While numerous explanations exist, none of which sounds intuitive.
I wouldn't be surprised to see DO either roll out DaaS next or partner with someone (Compose.io?) to do it. That's one of two things (the other being VPC, which I know they're working on per HN posts elsewhere) that make AWS/GCP tempting over DO for me.

That said, I kind of hope it's not Compose.io - they seem ridiculously overpriced for PostgreSQL compared to AWS's and GCP's offerings.
C/C++. In the general case, I don't believe its possible to resolve macros without linking.
I don't understand - are you being sarcastic or do you actually believe that slavery is an efficient capitalist state?
> We’ve gone from single-qubit devices to fully-functional 8-qubit systems that are now in the final stages of validation.

How hard of a problem can you solve with 8 qubits? For example, if you're implementing shor's algorithm -- it looks (very naively) from the wikipedia article that to efficiently factor a number of size N, you need about log(2N) qubits. So with 8 qubits you could factor the number 32 efficiently (is that calculation right?). Can you do things more difficult than 'factor 32' with 8 qubits?

(not intended as an attack at all, i genuinely just do not understand how to reason about the power of quantum computing devices with X qubits)
>there is nothing to stop US authorities from charging US companies with crimes if they were to comply with EU laws

There is nothing stopping you from shooting yourself in the foot either. (Or stabbing I guess in case you don't have access to firearms)
Which means: special deal with digicert. Or can you link me to a product page where anybody can sign up?
Oasis typically standardizes schemas and business logic. I see an API spec as an implementation of rules, which is really what a schema is. Typically schemas are defined in XML and this API is defined with JavaScript code examples for use in JavaScript, but again that is an implementation detail that shouldn't have significant weight on the rules of the API's design.
You might be surprised how much data science drives StitchFix; I sure was when this came out recently: http://algorithms-tour.stitchfix.com/
Secret Government Report: Chelsea Manning Leaks Caused No Real Harm
I don't use Algo, but I can vouch for using your own as long as the tradeoffs are acceptable.

Pros:

- You can choose a VPS provider close to your network for better speed.
- Less likely to be blacklisted.
- No connection limits

Cons:

- Not as anonymous to governments or IP-based tracking.
This reminds me the time google launched google maps in mobile. Now all job aggregators has suddenly decreased their value.
Why is it a deal breaker?
No thanks, Google already has its fingers in too many pots.

My guess is this is a response to Microsoft buying LinkedIn.
Hey @forgottenpass, perhaps I can shed some light. Please keep in mind these are my personal thoughts, not Codeanywhere's.

Building an IDE is a really, really, _really_ complex thing to do, and building one on the Cloud is 10X harder because the toolchains are much more complicated, and the technology is sometimes not even there and you have to break through technological barriers. It's telling that the other Cloud IDEs had millions of funding, and some of them still failed.

So the very first upside is that you can combine forces. 90% of the work is generic, and it's currently being done twice for 2 different Cloud IDEs. There's no point in reinventing the wheel. Add to that the Marketing costs that are also double, etc etc, and you can start to see how, organically, joining forces is better for both. Add to that the shared visions both companies had and the complimentary solutions/markets (one for Web Devs, one for Makers), and you start to see some big wins for all.
> Best just downloading the OpenVPN config files and plug them into something like Viscosity…

On macOS, I just created a new "PIA" service in Network. Is there any reason to use Viscosity instead of the macOS VPN client?
Lyft Reinvents the Bus
It's weird how people neg on some abstractions for Python but then brag about the absolutely intense degree of abstraction something like Tensorflow brings to the table.

It's almost like the qualification is that the reader can't even imagine writing the abstraction and therefore they can ignore it.
> with their probability of realization

But they, and this is expressed very well in the NOVA documentary about the Dover trial, always assume the components have to work as is in the end result. The bacterial flagellum, for example, is one of the examples they keep trotting out despite counter-examples of it used as an injection mechanism in bacteria, and other things.

To re-use the analogy from the documentary. They see organisms like mousetraps. And if any part is removed it no longer functions. That's true to an extent. It no longer functions as a mousetrap, but it could function for a variety of other things. The mousetrap is a flawed analogy because it does not pursue self-preservation, so it's easy to say "well it's useless now" from our perspective, but not so much when it comes to actual living things that we know little about.
Amazon is launching Prime Wardrobe
You guys are all wrong. Spaghetti code + gotos = instant moolah
Actually, based on my tests, there are only a few good services:

Abbyy (best recognition rate but by far most expensive), Google Cloud Vision (second best recognition rate), Microsoft OCR and... our OCR.space service with a very generous free tier and a competitive priced PRO tier.
I bet the founders of Indeed are glad they sold it when they did.

Any business that depends on putting their own search results inside of Google's is going to be a target of "forward integration."
It does, but it was just an option.

Really you have three options, free services have ads, paid services which require an account, or host your own.
Do we need to have a discussion on so many of the media outlets, including ones which host pro-encryption / pro-user-privacy articles, either failing to provide SSL, providing SSL but the certificate is from their hosting provider or other affiliated company, or having it setup just to redirect users to their http endpoint with prejudice, as is the case here?

$ curl -I https://www.bbc.com/news/technology-40326544
HTTP/1.1 301 Moved Permanently
Content-Type: text/html
Location: http://www.bbc.com/news/technology-40326544
Fortunately this is an easy thing for Imgur to solve in 2017 if they really want to with machine learning. Enough is available online that almost anyone could do it at this point.
I wonder what technology they use under the hood. Ceph? GlusterFS? Custom software?
It's less private for some forms of traffic, but for me, my main goal is to avoid ISP tracking and provide encryption on potentially malicious networks, which it works well enough for.
This is strictly false though. IDE integration can give insight into metaprogramming in many languages.