skysight-inc/HackerNews huggingface dataset:
No amount of checklisting and best practices substitutes for hiring someone smart to break your stuff and tell you how they did it. You can check all the boxes and still get pwned.

You can learn and run automated tools for 6 months and end up knowing 1/3rd of what a great pentester knows.

If you want to know you can resist an attack from an adversary, you need an adversary. If you want to know that you followed best practices so as to achieve CYA when something bad happens, that's a different story.

But honestly the security picture is so depressing. Most people are saved only because they don't have an active or competent adversary. The defender must get 1,000 things right, the attacker only needs you to mess up one thing.

And then, even when the defender gets everything right, a user inside the organization clicks a bad PDF and now your API is taking fully authenticated requests from an attacker. Good luck with that.

Security, what a situation.
I hope I'm not to special but I'm in the position where I'll happily do something for those people (e.g. pay more taxes so we can help them, or give my xbox to the local refugee center - actually I did that : - )

I still think we should close the borders and focus on helping the neighbouring countries handle the situation.

Why would a person who care enough to

- want to pay more to help refugees and

- want to help the refugees who are already here

want to do that?

In my case simply because todays solution is very suboptimal:

It creates dangerous situations for refugees (paying huge amounts to criminals to be smuggled across Europe, crossing the Mediterranean in inflatable boats etc etc.)

It creates problems here as well. Lets not understate that either.

And last but perhaps not least: we are letting down the people who are hit hardest by spending the money on those who have the resources to cross Europe already instead of helping neighbouring countries.
(e)BPF has the following guarantees:

* Strictly typed -- registers, and memory are type checked at compilation time. If you use something like Rust, you'd have to bring rustc into the kernel

* Guaranteed to terminate -- you cannot jump backwards, and there is an upper bound on the instruction count

* Bounded memory -- The registers, and accessible memory via maps are a fixed size. We don't have a stack per se.

Compiling Rust to this is possible, but it'd require quite a bit of infrastructure in the kernel to verify that the code is safe, versus the simplicity of eBPF. Early attempts at a general purpose in-kernel VM included passing an AST in, and then doing safety checking on the AST, but they proved too complicated to do safely.
You can take Stanford's Compilers course from Lagunita: https://lagunita.stanford.edu/courses/Engineering/Compilers/...
That's a popular adage: "I have a motivation problem until I have a time problem."
How Competitive Walking Captivated Georgian Britain
Seattle and Vancouver need to plan for 8+ earthquakes. There shouldn't be a single brick building in either city.
Right, standardizing on 25 fps in Europe came from PAL's 25/50Hz rate.

I think 24 fps for sound film originally arose from the requirements of the optical soundtrack: slower running 35mm film wouldn't have enough resolution for decent sound quality. That's my guess anyway.

Silent films were often shot on slower rates around 16-18 fps (which explains the widespread comic "speed-up" look for video copies of silent movies, as the transfer was done the easy way by playing it back at 24).
I think this is confusing the availability of video with the forced viewing of video.

If you're not comfortable watching a woman give birth, you can choose to avoid the many thousands of available videos. You don't have that option with factory farming methods.

Nobody wants to watch animals being slaughtered on an assembly line, but they should absolutely have the option to see what happens with their food. I don't think there's any moral room for "It would be disgusting and probably harm their business, so we shouldn't film it."
It is important to note that "Dynamo" and "DynamoDB" are two very different things that happen to share many of the same letters. DynamoDB is not Dynamo.
tasks.sort_by(&:difficulty).reverse

Readable code FTW.
The design and characters are copyrighted but my understanding is game mechanics are not.

If you want to reach out to IP owners, you should have a clear understanding of why you are doing it, because now you have another cook in the kitchen, so-to-speak. If you are planning to recreate the game digitally with same characters and mechanics, then I can understand why. If you are planning to use the characters in a new game, I can also understand why.

But if you want to just copy the game mechanics but alter the characters, it is permitted - everybody understands that game mechanics is free to be copied.
have the handlers of all endpoints inherit from a base class that performs the check automatically

I disagree. Much better to have a single endpoint which does nothing except validate opaque requests and passes them upstream. No good ever comes from having crypto code mixed up with non-crypto code.
Do you have any further info on why you so strongly recommend against JWT? My MO has been to know and understand the standard, what it provides (e.g. signed assertions a la SAML, albeit easier on the eyes) and what it does not (e.g. encrypted body without adding your own JWE), and to use it accordingly.

This is probably the first I've heard from someone I know is more than just some random HN commenter that JWT is not recommended.
I've worked with lots of people from different backgrounds, including individuals from elite schools (hell, I guess I'm married to one), and what frustrates me isn't the wealth (although there is always that story lurking in the background among those I know--they're never wealthy themselves, but they tell stories of legacy students everywhere).

What frustrates me is the assumption that because an elite school is so selective, the inherent abilities of someone admitted there are that much greater than someone who was not. In my experience, as the admission selectivity is raised, the signals being paid attention to are that much more random, for lack of a way of putting it.

It's kind of like Japanese fruit. Is it good? Sure, but is it best? Does that perfectly round melon mean that it's better than, say, that wonderful rare heirloom melon you bought from a farmer at that farmer's market, that was a little blemished on one side?

You have to have the stars align in just the right way to have the right application, plus a bit of luck. Does that mean that person isn't talented? Definitely not--they almost certainly are.

The thing that's much more pernicious, to me, is the assumption that that person is necessarily any different from someone who, say, went to a state school and graduated with top honors.

The most talented people I've worked with were not necessarily from elite private schools; the latter were talented, but not any more so than many of the other people I've met and respected.

But I do think that they were often given the benefit of the doubt, or kind of revered or something, based on their degree, rather than what they had accomplished. It's as if the person from the state school had to work harder to gain the same respect, even though their actual accomplishments said otherwise.
It's a meme generator. Nobody's going to believe that the person who operates the site "said" anything on there.

Next are you going to upload an image to imgur that "looks like" the creator of imgur is saying something bad?
Create a Chess or Go coach that projects attack lines or shows the future strength or vulnerability of positions on the board.
Show HN: Rel, a CLI tool for creating personal graphs and writing them to dot
Thank you for replying.

The second one is not a quote. It is more like a TLDR of the overall article.
How Emojis are surpassing the value of words
A fellow student of mine did a study back in 2005 about this. He found that the worst time to fix a bug was Friday afternoon, as it introduces the most (new) bugs into the code.

I see similarities to another area where I have more experience: business meetings. I believe that most people are terrible at meetings held in the afternoon, either due to heavy lunch, or just because it's after 3pm and they are simply tired. A single meeting like this can cause great damage to the individuals and whole teams, measured in intangibles such as motivation, trust, momentum.
There are so many blog about this topic on account of that it can be good game platform
What It Costs to Maintain an Art Collection
proof-of-retrievability, I imagine somewhat like what Storj, Sia and Filecoin do.

zcash is the currency.
I was thinking the same. I don't have children, either, but observing my friends and siblings who do would make me estimate this at 40+ hours/week. (Estimate applies to children below age 6-8. Of course, it's progressively less the older and more independent the child grows.)
Do incandescent bulbs last longer with DC, since they're not switching on and off 60 times a second?
What are some more trusted alternatives to JWT for signed tokens with claims / expiry?
Well, in ORC you get paid for storing things, in IPFS you don't.
Winds Trigger Pond Growth
So basically it solves all Freenet problems?
You haven't heard the story about the person who 'cried wolf'?
The Bw-Tree: A B-tree for New Hardware Platforms (2013)
I suspect English is the world's first language right now because of the British Empire, and the Pax Americana that followed (and continues still)
Document Tracking: What You Should Know (2013)
I have an even simpler wish. All I want is to comfortably listen to my audiobook when running without going deaf when Strava comes on to give me pacenotes. My kingdom for per-app volume control!

That's one benefit of podcasts. They often have lower quality but louder audio so I don't have to pump up the volume when I'm out and about.
I can confirm that this is not true in the case of IITs. Admissions are purely through a your score in a common examination and nothing else.

Getting into CS/ECE in an IIT (especially the ones of repute) needs you to be in the top 0.01% (or top 1000 among a million) that give the exam every year.

It is almost a certainty that every student that ends up getting a top 1000 rank for IITs has slogged his ass off for the 2 years of their life simply to get in.
It's not about "trust" it's that keeping the accounts and books consolidated even within a single bank is problematic and between banks even more so.

Banks lose billions each year and i mean lose as they have no idea where the money went. Account consolidation within a bank is a huge enterprise.

Even within a single entity like a bank a blockchain that governs all accounts and transactions is hugely beneficial because of the consistency and the trail any action within it leaves.
Some links I found:
http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo...
https://mailarchive.ietf.org/arch/msg/unbearable/QoybOl0cciD...
https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...
If your C-api throws and then doesn't handle exceptions, then it's not a C api, it just happens to use the C ABI.
> Sometimes the best thing you can do to get the job done is to stop working on it for a while.

This. I like to have several side projects at once so I can switch to another one when I'm stuck on the current one.

On the downside, this procedure made me question if I can actually work as a programmer professionally, where I don't have the liberty to just leave any task assigned to me lying around for a week (or a month). It worked out nicely, though, since I found that I can get my train of thought unstuck by discussing the problem with a colleague.
Maybe if every American took a thermodynamics course where the teacher insisted on memorizing the unit conversions we would not have this issue! What an awful semester...
>“The public knows the real criminals are Planned Parenthood and their business partners,” Daleiden said.

https://www.usatoday.com/story/news/nation/2017/03/29/felony...

Abortions are not illegal in the US, nor is receiving a medical consultation on an abortion. The Planned Parenthood video guys weren't exposing a crime.
There is value to constant volume, but I think a lot of the loudness war came from a time when there implementing a compressor on the user's side was expensive. It's trivially cheap now, basically every device you own that can produce audio now is capable of implementing a decent digital compressor with no additional hardware costs and about 5 minutes of an software engineer's time. If this wasn't hard when the loudness war set in, we'd probably just have a checkbox that defaults to 'on' in all these devises instead of the master being messed up. In other words, the timing of cheap, low power audio DSPs missed the boat by a couple years.
Most web frameworks I'm familiarized with have a concept of middleware, where you can perform any authentication checks before yielding.

Having read a bit into the topic, I'd +1 avoiding JWT. Getting authentication "right" is difficult. I think most applications should default to using stateful authentication. By the time you actually need stateless authentication "to scale", you'll hopefully have enough experts on-board to help you understand the tradeoffs.
Many years ago, in my first programming job, I had to do an ugly hack to fix an issue in production that was preventing other people from doing their jobs. In the minutes before I made that decision, while I was contemplating the problem, my colleague (a senior) asked me with a very serious face: have you ever heard of the POG methodology?

"POG"? No... should I have?

He smiled and explained it to me - Programação Orientada a Gambiarra, or "Gambiarra Oriented Programming".
The article is highly misleading. Only 200 students got job offers from international companies in on campus placements.

The majority that head out go for graduate education. The statistic doesn't take them into consideration.

The 200 is absolutely bogus.
Ethereum whitepaper in Kindle Mobi/iBooks Epub formats
Clever reverse psychology marketing. "So good it had to be controlled, watch out, you might not be able to handle it". It's a bit like the "call your doctor if the erection doesn't go away after 8 hours".
Paywalls, great. I wish HN would just block submissions that did this.
I bought a 2 letter domain on a .vg and a .mg TLD. It's amazing how many websites refuse my l@up.vg email address on signup as "not a valid email address".
I think Kerberos [0] is the industry standard.

[0] https://en.wikipedia.org/wiki/Kerberos_%28protocol%29
What color is your Instagram?
Huamns, of which Cops and all law enforcement are part of.
GraphQL Server: Resolvers and Caching Conventions
Vance Morrison is a pretty significant guy in the windows (.NET) tracing world

https://blogs.msdn.microsoft.com/vancem/
> None of the work you do has any tangible results outside of the end goal.

Depends on the field. From what I hear [citation needed], what you describe generally holds true in the humanities.

In contrast, I have two friends who're submitting their PhD theses around now, and they already have a ton of tangible results: They're required to publish papers during the research period for their thesis. They got to speak at conferences because of their published findings. They collaborated with other researchers whom they met at these conferences. And that, again, fed back into more papers and a better thesis. Even if they didn't get their PhD (which I'm sure they will), they still have made a name for themselves in their respective fields.
My favorite example of this at the moment is UEFI Time Services. Time is current local time, TimeZone is an offset from UTC in minutes, and Daylight establishes whether DST should apply, and if it has been applied. So yay, no more time incompatibilities with multiple OS's. Except no, not even Microsoft Windows 10 sets the TimeZone value to the actual UTC offset! They set it to EFI_UNSPECIFIED_TIME. And so does Linux. And so does macOS. So we're still fakaked.
OK, Wikipedia has a nice article about it.
https://en.wikipedia.org/wiki/Preposition_stranding

Though my sentence was grammatically and semantically correct, but the
sentence I was complaining about was semantically invalid, so it was a little
too much from you to point that out (stranding here fully intended).

> If you cc me on all your work correspondence, I'll be happy to point out any grammatical errors I find (for a fee, obviously).

A "nice" offer, but I'll pass. First, I'm not in a position to copy my work
correspondence to a random dude from the internets. Second, my work
correspondence is mainly in my native language.
"He would have finished Goddam off then and there, but pity stayed his hand. 'It's a pity I've run out of bullets, he thought.'"
That is exactly the problem. It is easy for programmers to start with a 3D sphere and start randomly projecting things on to it. However the earth itself is an ellipsoid that bulges around the equator, so again you have a projection problem of people trying to put one shape onto a different shape.
Ask HN: Legal implications of ICO?
Hello, can someone point to resource which would describe the legality of ICOs?

A lot of coverage mentions "scam" and almost all ICOs say "can't be bought by US and EU citizens"

Is there a blog post / paper on that?
Arguably IPv6 also solves this problem :P
Buying .eth is harder than .com was twenty years ago
As the U.S. loses political importance and mindshare, sites will stop using U.S. units. Conversion to metric will eventually happen.

As for language, I'm kind of split. On one hand language is a tool for communication that becomes more efficient the more standardized it is. On the other hand, language is closely related to art and culture. I'm Icelandic (and a poet at heart) and I love my language deeply. I can succintly say things in Icelandic that can't esaily be expressed in English. And that probably applies to every language.

So I'm torn. I don't want to lose my language. But I also want a more integrated world.
If you click through a twitter post you can get through on WSJ: https://twitter.com/OurMissingNews_/status/88354772711571456...
"In bursts" as in "40 hours with the occasional 60-hour week" or "60-hour weeks with weeks off in between"?
The IDE is not very mature. For example if you use the dialog to search through files, the UI locks up while searching. Usability generally is low...
> User own resource id should be avoided. Use /me/orders instead of /user/654321/orders

Can somebody explain this?
It's more complicated than that, though, because a C library seldom controls the callstack. Exception throwing is viral.

A valid example would be using a pure, fully ANSI C library with no dependencies in a C++ program, but then, in a callback PASSED to C APIs, accidentally allowing an exception to leak. Then, your runtime will try to unwind the stack and can implode on itself.

There's definitely more valid cases where this can happen, but since C APIs generally do rely on callbacks for many things, it seems like a logical one.

Another case would be C-style dispatch tables like SDLs RW interfaces. Implementing them to interact with C++ classes could definitely cause problems.

Of course, happening to use the C ABI is a valid use case that actually works if you really only use the C ABIs, but once a single exception is raised all bets are off. This kind of sucks.
I would take this point further as evidence why a developer, who does not wish to spend time on non-product engineering, should not join a small or medium sized business.

It is fine to have an engineer do both jobs, but my stance is that time spent on non-product engineering needs to be accounted under the proper accounting bucket, in order to avoid diffusion of responsibilities.
No, I'm saying that I trusted Ethereum would be built when it was a project idea although Vitalik was only a blogger, and that I'm trusting Daniel because hi has even better chances of delivering.

And that is the reason why I bought in both crowsdsales. Your call...
Nice and simple. I tend to use a wrapper around BSD tree.h and SQLite for persistence. Longer insert/update times but quick access and you get the SQL language and tools for free.
That's so stupid.
> I'm sure I'll be downvoted which will be further proof of what I'm saying.

This is an arrogant and confrontational statement to make, especially given your respectable admission of lack of awareness outside of CSS/js.
There's various advice on this page:

https://ico.org.uk/for-the-public/
I've been impressed by the Sea star Project (http://www.seastar-project.org/). It was developed to build a high throughput database (ScyllaDB) but has since been used in several other projects. I recently spent some time evaluating it as a starting point for a new application.

Also, a fan of the elegance on display is this serialization library: https://github.com/msgpack/msgpack-c
The original LISP is pure functional in the sense that you don't change state of an object.
Elon Musk says entrepreneurs should work 80-100 hours a week.

https://www.youtube.com/watch?v=GtaxU6DZvLs
The Perfect Traffic Jam; Hurricane Floyd: Lessons in the Evacuation
Is it even possible for any non-trivial programming language to not be Turing-complete?
He just means "on balance, your success lies in your team's hands".

Yes, there's a lot of things a manager can do to screw the project up. But ultimately, it's the team that's actually doing the work. And ultimately, your job is not to "do the heavy lifting", or make all the key decisions, or figure everything out. They already know what to do. Your job is to enable them to succeed.
The algorithms that determine perceptual loudness are very inaccurate, so it's still possible to game them.
If you have to ask this question, maybe you shouldn't have applied for the position.
Even without MX/TXT records, your apex will always have an SOA, which disqualifies it from using a CNAME(per RFC).
Interesting. Does this domain have any possibility of hosting http apps, or is this completely limited to dapps?
Let's take Standard Oil. They never had a monopoly - at their peak they had a 90% market share. SO's market share slid steadily throughout the years of the anti-trust trial, and Rockefeller was unable to stem the slide. (The competition figured out how to beat him.)

See "Titan" by Ron Chernow

> pretend

I know what the popular wisdom is. But dig a little deeper and you'll find it is not correct.

> General Motors

was formed in 1908. The Sherman Antitrust Act was in 1890, so GM could not have been the reason for it.
I believe its because its a more explicit indication that the route MUST have access control logic etc baked in.
While I kinda agree, I also have found, most of the time, that by the time I finish building something that I thought didn't need a bigger thing...it actually needs a bigger thing, and I have to pull in SQLite or something else to make it all work reliably and fast and for all the data-related features that ended up being needed by the end.
Yes it's a spin by Branson to suggest that the planes were the solution to seat back entertainment. They'd have done the planes anyway because it's grow or die.

The bigger risk today is Wow! and norweigan airlines with cheap flights.

But I've always found virgin to be a good experience for a fair price. On transatlantic flights, BA is more expensive for less and the American carriers are just awful. They get away with it because their hub-spoke routes have little competition.
i think you meant Hitler diverted troops intended for what he and his generals had agreed was their key objective, Baku, to battle over worthless Stalingrad.

Capturing Baku was the only chance the Nazis ever had of beating the russians.