skysight-inc/HackerNews huggingface dataset:
Different strokes for different folks. I think intentional bugs are far worse than unintended, and scanning a c project for buffer overflows is relatively trivial compared to scanning tons of libraries for flaws so obfuscated they made it through review.

In my mind technical analysis is incomplete at finding 100% of intended or unintended flaws in either system, but the DIY approach allows for trust in the authors whereas a deep stack makes attribution muddy.
HotelFlex (YC S17) is hiring a freelance React front end dev
Get in touch if you're interested or know of anyone else who might be:

rich@hotelflex.co

Thanks!
I work on the Let's Encrypt project and this is my own personal opinion, not necessarily the opinion of EFF or ISRG.

There are several reasons that it could be good to have multiple publicly-trusted CAs out there, though most of them don't depend at all on the relative market share of the CAs at a given point in time.

Security risk If a particular CA is compromised through an attack and its intermediate certificates need to be revoked, it would be good to have other CAs already ready to continue issuance to the public. Even if the CA intends to resume operations after a compromise and user-agents are OK with that, it probably wouldn't be prepared to resume operations immediately.

Geographic risk It would be good for availability to have CA datacenters on multiple continents, not just one.

Jurisdictional risk The government of the country where a CA operates could try to compel the CA to stop issuing particular certificates, for example in order to enforce international sanctions, or to facilitate espionage by trying to make it harder for people to get authenticated encrypted connections to certain services. A government could even force a CA in its territory to cease operating entirely. (There's also jurisdictional risk in the other direction, of governments trying to compel misissuance, but this risk is strictly increased by having trusted CAs in more jurisdictions. In general, having more CAs increases the risk of misissuance, while decreasing the risk of certificates being unavailable to a particular site because people don't like that site or its operators for some reason.)

Continuity risk It would be safer to have CAs with more different kinds of funding for their operating expenses.

Institutional/governance risk A particular CA might some day decide to do things that relying parties find improper. Having more CA alternatives can give the relying parties more plausible leverage to get the CA to align its practices with their preferences. (As with the jurisdictional risk point, only a decision not to issue certain certificates can be directly addressed in the short term by having other alternatives. A decision to issue certificates that other people think shouldn't have been issued can probably only be addressed this way by removing trust from a particular issuer.)

Looking over this thread, I do want to emphasize again that misissuance risk gets worse, not better, when there are more CAs. If you're particularly afraid that CAs will be issuing certs improperly because they get attacked or coerced or do a bad job of validation or internal controls, you should probably want fewer CAs rather than more, at least as a response to that particular concern. This is because CAs in the X.509 PKI can't "contradict" another CA's issuance; every assertion about a binding between an identifier and a public key is cumulative and operates in parallel and in addition to every other assertion.
Show HN: Tool to switch between Kubernetes clusters easily
If that section was at the top of the post, there might be a very different reaction to it.
The language of programming
To improve AI, scientists may have to make it worse
Very nice article, thanks for sharing! It reminded me of this one, written by my coworker Tyler: https://medium.com/smells-like-team-spirit/teamwork-and-ment...
Sample size is too small and correlation does not equal causation are the worst. Teachers did a great job teaching those things, but sometimes correlation does equal causation or at the very least is interesting enough to warrant a closer look rather than to be dismissed so easily. At the same time, a sample size of one is good enough to prove something in a scientific way. If I claim to know the lottery numbers, I can prove it by winning the next lottery. In doing so I beat 1 to 5 million odds, which are greater than the 1 in twenty that most studies require.
Yep. Severance is pretty common when employees are "laid off" i.e. their employment is terminated not because of employees fault. And generally, you are informed of it, and your credentials and such are revoked almost immediately.

Quite different from when you voluntarily leave, when you give notice and do knowledge transfer and such. I imagine that is because the employee is unlikely to do anything bad, since they likely have a better future.
Good enough + soon enough beats "best possible", or even "better later".

In this case Ethernet + TCP/IP beat OSI.

Also, JavaScript beat any number of sensible scripting languages. Houses are frequently constructed such that they are not very serviceable.
The amount of music in my feed and the trouble of curating it all. I found new songs I loved every day, but being a programmer, and having to switch to the SC browser window/tab to hit shift-right-arrow to skip a song, or space to pause it, became too troublesome.

I eventually switched to Spotify, since I could have global keyboard shortcuts for the app. If SoundCloud had a desktop app I would use that instead of Spotify in a heartbeat (assuming I could play my own music as well).
Hey, SoundCloud employee here who's leaving -- I'd actually love to take you up on this offer. @brianegan on Twitter if you have a bit of time to DM. Thanks so much!
>It's that simple.

It's never that simple :)

What does "better campaign" mean exactly?
I decided years ago to avoid detail in "I'm sick" emails, because I don't want to one day think "do I need to say I have horrendous diarrhea, or can i just say I'm sick?"
10 common data structures explained with videos and exercises
here's some more purrs: https://mynoise.net/NoiseMachines/catPurrNoiseGenerator.php
Coverage:

Verge: https://www.theverge.com/2017/7/6/15929312/google-blocks-vr-...

Wired: https://www.wired.com/story/google-blocks-vr/

Engadget: https://www.engadget.com/2017/07/06/google-blocks-virtual-3d...
Yeah, we really have one party, the business party. The Dems are the business party that is more multi-cultural and socially progressive...and the GOP is the business party that caters to the religious folk and more socially conservative...either way, we get the business party.

https://www.cambridge.org/core/journals/perspectives-on-poli...
>> 'easy'

>> Requires a soldering iron

Pick one. :P No, this is a cute project, though.
What's the difference between gh-ost and the Percona tool? ( pt-online-schema-change ) Also did you try to use a recent version of MySQL that supports live migration?
It's as good a text editor as it is a terrible operating system

(to flip an old one on it's head).
Are the Amazon Dash buttons still hackable? If so, they are cheap...$5, and shouldn't require as much physical alteration.
The "privileged port" model was basically dead at the time of the Morris worm 30 years ago. It should have been sorted out in that time but there was never the momentum.

Everything in UNIX is a file, apart from the things that aren't. If ports were files, you'd be able to chown them or put them in a group for delegation purposes.
Hackers may be able to predict passwords through brainwaves – study
Couple of professors discussing what applicants should they accept into musical school.

Jew professor: let's take 9 Jews and 1 Russians

Conservative professor: let's take 9 Russians and 1 Jew

Liberal professor: let'ts take 5 Jews and 5 Russians

Eldest professor: you are all bloody nationalists! Let's take 10 best musucians!
Any reason you don't make use of iTunes or the charts in other podcasting applications?
(Author here.) Let me begin by saying that this post is intended to be historical. If you've ever wondered why "git checkout" both switches branches and restores working-tree files, or if you've ever wondered why "git reset" both rewrites history and unstages hunks, this post has the answer.

History is about people making decisions. It wouldn't make sense to write about the history of nations without naming any names, and I think it wouldn't make sense here, either.

Second, while I am critical of these historical decisions, I don't purport to be better than Hamano. There's a whole section of this post saying that "you or I might have done the same thing" for the same reasons.

I especially don't accept your charge that this is "ad hominem." I don't argue that you should agree with me because who Hamano is. I don't (and wouldn't) call Hamano any names, call doubt on his character, or even question his intelligence or competence.

Everyone should evaluate these historical decisions on their own merits. But anyone who wants to understand why git works the way it does must understand that these are Hamano's decisions, and decide for themselves whether these decisions were good or bad.

EDIT: A number of comments here have said that the complaint has to do with the number of times I mention Hamano's name, so I've updated the post to remedy this.
Isn't this exactly what shared hosting is? I bet companies like dreamhost regularly put 50 clients on a box. And Webfaction[0] will even give you pretty open shell access to a shared environment.

[0] https://www.webfaction.com/
Mixcloud founder here, thanks for the vote of confidence. One key difference is we internally measure success or engagement in terms of minutes listened not play counts, and actively optimise for this. So often the visible play metrics don't actually respresent true human engagement. It's something we're thinking about a lot internally right now, and we might start exposing it shortly. I suspect most people will be very surprised for the better when we do.
Soundcloud has it's issues, and personally I find the mobile interface annoying, but what are the alternatives for music creators (and discovery)? Asking out of curiosity. Would love to find a good alternative.
I find it difficult to seriously address comments to this thread. People still referencing 10gen and talking about data points from 5-10 years ago (2009, 2012, 2013).

You do realize it's 2017 now, right? Many things have changed in MongoDB (and in the IT world in general) during the last 5 years. MongoDB is a mature, established, full-featured database - recognized by Gartner as a "challenger" to more established RDBMS vendors like Oracle and Microsoft.

http://bit.ly/2uP3Obi

MongoDB has many built in features that are extremely attractive for building modern applications. Built in HA & DR, horizontal scalability, multiple storage engines, rich indexing and query capabilities, enhanced BI features in aggregation framework, and many more...
A doctor administered evaluation or a patient self-survey is just as objective as any other test.

These tests take a measurement and based on peer-reviewed statistical studies make a determination as to whether or not the measurement falls into a pathological range.

This is exactly the same as measuring blood pressure or cholesterol. You read a number and decide if there is a statistically valid correlation between that number and an identified disease.
This is the way the big guys (Accenture, TCS, etc) went a few years back. Keep that in mind as you try this -- the further you go down this route, the more the market pressures will force you into an offshore sweatshop model. A lot of product design shops have gone to more of an agency model, which makes sense here too.

It actually works pretty well as long as you realize that the "accounting" works differently offshore -- for every good developer you get, you're paying to have someone's dead weight cousin on the project as well. In the end, it's still cheaper than on-shore, just don't expect everyone to pull equal weight.
Distinct enough, sure.

Unique means something else.
Any chances for Android positions in Berlin office or whole mobile development team is SF based?
99% of the public doesn't donate either.
It's like Elm the framework or language or whatever it is. Every time I see it on HN I think "what, like the mail client?"
SEEKING WORK - Remote (based in Chicago)

Web developer, recently pivoted into commercial game development and interested in moving in that direction or related multimedia work.

Currently part-time, seeking another part-time job (max 20 hrs/week) to pad it out.

Skillsets

Game dev: C#/.NET, HLSL, DirectX, MonoGame

Web dev: LAMP stack, JavaScript, MySQL, MongoDB, CSS, HTML

6+ years in web, < 1 year game dev. 2 years remote work experience.

Email: chris.cajas.m@gmail.com

Github: https://github.com/ccajas
So a remote work office that you rent? Also, that email alone screams questionable to me.
Should I be surprised that this doesn't work with Google's own Daydream? I would have assumed support for that before Vive and Rift. I'm assuming there are technical limitations to doing this on Daydream but is it just not doable at all on it? Is the control not precise enough or do you need two?

Edit: Okay thanks for the clarification! I guess I wouldn't be surprised if Google has it working internally on their own standalone Daydream hardware.
I still don't see a problem with this. Why should Junio not be responsible for the issues in his code? There is no shame in taking deserved blame. Project maintainers are usually pretty used to that, and they're typically their own worst accusers.

It's not like someone as storied as Junio, who has maintained git for as long as its been a serious project with applications beyond the kernel, risks being fired because he made a handful of questionable decisions. He is, after all, only human. Only the insecure fret over every shed of blame.

It is, in fact, considered rude to circumvent/bypass/ignore the original author by saying "the code was wrong" without first giving the author a chance to explain the rationale.

Ultimately, the point at which "naming" transitions into "shaming" in a technical discussion is a matter of interpretation and balance, but I don't think we need to completely remove considerations of code parentage from technical discussions, which you seem to be advocating.
or do it to the binaries:

> setcap 'cap_net_bind_service=+ep' /path/to/executable

huge blog post for what is literally a one line fix
Tough news. And it's great to see posts from people who are in hiring in SF, offering to take a look at affected employees.

We built http://www.layoff-aid.com/ specifically to help candidates and companies find each other, with the main goal of helping candidates find new homes quickly.

More on HN last week: https://news.ycombinator.com/item?id=14647365
Any information would be appreciated
What if id like to scan objects with my phone's cam, and use those in VR?
This comic artistically renders that feeling. I, too, know it well.

https://xkcd.com/208/
This is what Martin Fowler refers to as the Tolerant Reader pattern.
https://martinfowler.com/bliki/TolerantReader.html

Code should tolerate all sorts of bad inputs.
Code should produce pristine outputs.

Just like being a model member of society
> How did we end up with the nested complexity explosion of OS->VM->containers->... instead of the simplicity of multi-user operating systems?

> [...], it pushes about 5-10 megabits of traffic most of the time but the software it runs only needs about 10mb of RAM and less than a megabyte (!!!) of disk space. It also utilizes less than 1% of available CPU.

> The virtual machine it runs on, however, occupies about 8gb of disk and at least 768mb of RAM. All that space is to store an entire CentOS Linux base installation, [...]

The exo-kernel and uni-kernel people have the opposite idea: go all the way to virtualization, and eliminate the traditional operating system.

You can still have all the conveniences of the programming models you like, but eg file-systems and network protocols will be implemented in user level libraries.
http://www.layoff-aid.com
Also Petya/NotPetya. And it used NSA's EternalBlue, too.

https://redmondmag.com/articles/2017/06/27/petya-ransomware-...
Now that I also actually take a look, while his theory has not panned out the way he thought, it is true that Amazon would have been a poor investment for most of the decade following 2000.
a woman’s bones (now lost).

I thought the consensus was that they turned out to be a man's bones (and not even matching Earhart's proportions). Which may explain why they ended up getting "lost".

That leaves us with just that patch of aluminum, of unconfirmed origin. I would call that kind of an indication "mildly" rather than "extremely" suggestive.
Wow, I couldn't believe it with how minimal the page is, but yeah this is insane, it's just a white page with javascript disabled.
https://githubengineering.com/gh-ost-github-s-online-migrati...
Can you say why? I don't understand the link.
What? Really? You must have had a pretty sad career.
>I though Duchamp was making fun of the art world.

This piece is part of the DaDa art movement. They were not so much making fun of the art world as they were deliberately revolting against the world. It started about the same time WWI did and it's mostly symbolic of people (not just the artists) rejecting a society that could cause such a massive war.
Being a "meritocracy" doesn't mean that you have to reject pull reqests until the author gets it perfect. For someone who's new, you can instead have someone with more experience with the project fix it up as an example, and for the second give some advice but fix it up for the author if the author seems stuck, and for the next one, ...
I always favor STARTTLS in favor of implicit. I say so since implicit TLS on SMTP (465) is deprecated.
I don't love the name, but I'm curious if you forsee actual confusion or cases where it will cause real issues? There might be, but I'm having a hard time imagining any, given the completely different contexts for these two elves. When one's a platform and the other's a file format, I'd guess that most usage of the word "ELF" will reveal which one the speaker is talking about through context.

Many years of C++ dev in Linux, and I can't say I ever used "elf file" in a conversation, but it's worth pointing out that Linux created the naming conflict, not Facebook. The Linux ELF predates a short man dressed in green that works for Santa Claus by 130 years, and by the English usage of the word by about 300 years, and by the Norse mythology since the Middle Ages. ;)

My first thought on the name was "[E]xtensible [L]ightweight [F]lexible" fails to communicate anything meaningful to me - it doesn't hint that it's a platform for research or that it's for gaming. It's adorably hopeful about being extensible and lightweight and flexible, but I don't know what it's being compared to, and everyone's software starts extensible and lightweight and flexible, only time will let us know if they manage to keep the barnacles off that haunt all other software.
If his experience was anything like mine it isn't the working poor. It is the young workers who are not poor. They are still living at home: they do not need to pay for their room, meals eaten at home, health insurance. That is every penny they earn is pure spending money and so despite making minimum wage they are rich with no need to work as many hours as they do.

When I was working minimum wage there was also the working poor: they needed every penny. If they called in sick you knew they were sick. If you asked them to work overtime they did their best to take it because the extra money was needed (they often couldn't find a sitter on short notice though). They didn't stay in minimum wage for long, their efforts were noticed and they were offered promotions to management (not all accepted because management often meant moving away from family, but in that case they still got maximum raises until they reached the top of the pay scale).

Note that many of the working poor got themselves into that position because of their choices, generally they had a kid at 16 and dropped out of school as a result (at best finished at the bottom of their class). They were failing to dig themselves out of the hole of their bad life choices because that kid takes the time needed to get a better education. In short they lack moral fortitude in that they were (and are...) sleeping around, but not in that they are not working hard for their employer.
IIRC you have to sniff for its ARP probe, it works most of the time but it's kinda finicky. An ESP8266 is a similar price.
A call to friends of those who have been affected by online harassment
yup, my last.fm data is my insurance policy. Still enjoy Spotify quite a lot.
Five Best Practices for Software Development Projects
I don't disagree, it was a bit alarming and while our PTO policy is better than many, there are still lots of competitive employers who offer better benefits wrt time off.

It is nice to never actually need to provide a reason/note to be out, but I think the combination does stress some of my coworkers (e.g. "I don't want to take vacation because what if I get sick", "Oh great, I'm sick, now I can't take vacation").
4 Undeniable Facts That Prove That Coffee Is Good for You
Veteran Startup Office Hours: Get Business Advice from Experts
While I'd like more info on what exactly the device does and perhaps see a demo, Red is not a scammer.

They are an industry leader in digital cameras of which are used to film many major movies (http://www.red.com/shot-on-red)
Magnitude 5.8 earthquake rouses slumbering Montana residents
I'm pretty sure it's derived from cuckold.
10 Times the Internet Was Brought to Its Knees
I use kubernetes-lego for this and it's all automatic, zero hassle.
vive and rift are accurately positioned in space while daydream has just an approximation from the gyro and a lot less inputs. So yeah, basically just not doable on this platform and similar ones like samsung's
Americans wouldn't know what to do with a kilogram anyway.
My understanding, home desktop performance.
Somewhat related, but I always thought it would make sense for browsers to use DNS based service discovery to find the correct HTTP port, and then fall back to 80/443. That alone would make it easier for users in a multi-tenant environment to self host, IMO, and eliminate some of the need for SNI.
Performance aside, Daydream does not have 6DOF.

There's a bunch of hacks you can do around 3DOF, but the experience would be severely crippled without 3D tracked controllers.
For me as a producer is also a joy to sell my music through Bandcamp. The tools to release and monetize my content are far superior than Soundcloud, which in our label we use just to showcase singles without download option.
Right, it's not your job to do anything. It is perfectly valid for you to feel frustrated in exactly that way.

All I am saying, is that their are third parties who you are not interacting with, who could be persuadeable, who will read that frustration and are going to find it alienating rather than persuasive, and therefore you end up creating more people in the world who think there is no real problem.

It may be more constructive to simply disengage if you feel that exasperated by it. Both for persuading other people and for your own sanity. That's all I am saying.
Hard Truths about Programming