skysight-inc/HackerNews huggingface dataset:
> What happens if the attacker spoofs DNS?

They would also have to get a publicly-trusted TLS certificate for that domain. U2F is HTTPS-only, at least on Chrome. If the attacker can do that, you have bigger problems.

> Also, the scheme you describe requires the user to trust the web browser. But, if the web browser is, say, on a public computer, it can't necessarily be trusted.

No one has really solved secure authentication on a compromised system. I dare say it's not a problem that can be solved.
I encourage you to pick up a biochemistry textbook.
The domain for BTC-e has been seized
Harvey Mudd internal report mentioned: [1]

(That's now inaccessable (403 Forbidden), and the page that linked to it, "http://tsl.news/news/6611/", is failing with a Ngnix error (502 Bad Gateway).)

I got to read it before it went down, and it sounded like they'd reached the student workload levels associated with the first two years of any serious engineering school. Their restructured student body wasn't ready for that.

[1] https://dl.dropboxusercontent.com/content_link/S4gumhMUSUdKB...
Yes, I think there's a lot to be said for that too.
Working, youtube, giant ebook reader, candy crush desktop, vlc etc.. whatever it's your free choice to use a laptop in an environment that is not setup for such and deliberately in the space where the person in front can rightfully recline their seat at any moment. The airline sells you a seat from A to B, and in economy a very basic one - no one reasonable has any false expectations about this, they did not sell you a co-working hot working desk 38,000ft in the air with accidental damage insurance for your very important laptop.

If you put your laptop in the middle of the road and my car runs over it then I wouldn't be making it right, not the best analogy but its a similar shade of grey. Your position that this is either the airline or the guy/gal in front fault, and you've done nothing wrong, is laughable - it's your choice, your fault, was it a shock that the seat in front can recline and the person hasnt got eyes in the back of his head? how is a non-aisle dude even meant to know your using your very important laptop? I can barely move my feet nevermind my neck 180o and 50cm over the headrest..

Now, out of manners, if I noticed you had a laptop when I boarded or after going toilet, I'd probably try to give you a heads up presuming you werent on your noise cancelling headphones too, a brief 'hey dude, Im going recline in 30 seconds' but that's just me being polite, it's not mandated and I definitely don't expect it of the guy/gal in front of me when travelling economy.

Go business, or get company to underwrite the laptop use in economy, or just put it away... I don't think anyone in the seat in front would make you whole for your own careless mistake, anyone?
This holds true for any 2FA solution, and is generally solved by services that use this kind of technology (e.g., in the form of FIDO U2F) to allow you to register more than one device (so you can have a backup key) and crucially, to allow you to generate a large set of security codes that can be used once to reset access to the service. These codes you would ideally print out and store with your other valuables, or backup in some other manner not dependant on your security keys.
5 Email Marketing Tips to Try This Week
How to Make Fun of Nazis
Why left pad numbers if you could simply use better tools that properly sort numbers (instead of using ASCII order which doesn't even make sense for ordering purposes). For instance, use `ls -v` instead of `ls` (possibly as an alias).
Async / await also need a idiom to accompany on how to support cancellation. In practice, cancellation happens a lot because the unbounded latency for async operations. Without a throughout support, async / await syntax is probably usable on server side somewhat but still hardly applicable on client side (as the latency is unbounded). On the other hand, C# does go through the pain and added cancellation support to all its standard libraries async API.
Science might not do that job, but a least it can point out to you the flaws in your reasoning, and, once you have settled on an reasoned objective, help you construct effective tools, techniques and programs to reach that objective.
In other words, Science is what keeps you from insisting earth is the center around which the universe revolves, sacrificing virgins to the rain gods in a drought, or investing in gyms to get to the moon by improving the high jump.
I think U2F keys either work (obviously) or don't.

How could they fail silent? Bind to another URL? No, that's a functional failure.

Leak cryptographic material to an attacker? I guess not, unless the attacker controls the web browser, and then all bets are off.

I'm not a security expert, so take with heaps of salt, but I can't see much exposure here.
I have 2 keys, one stored in a safe place. They are cheap enough that you can have several, but then it becomes a challenge to keep your various accounts up to date. I wish that openid was still well supported as I would like to have one authentication provider for all my online accounts.
The closest thing I've seen that seem likes a real replacement is Bazel, but I haven't tried using it for anything but a couple toy projects yet. The concepts seem solid though, as expected from Google.

My main complaint about make is that relying on timestamps, while fast, is error-prone and doesn't work with idempotent commands that might refresh the timestamp without altering content.
Vishal Sikka Resigns as Infosys CEO
Micro-Platform Floats on a Sea of Droplets at MIT
> Hopefully it will be tested on major projects

Twitter has pretty big resources. It's probably feasible for them to spin up a build farm that runs their compiler against all active Scala projects on GitHub, measuring error count and compilation speed as they go along.
Aside from all the innuendos and made-up proof, the one true statement you can make here is that Kaspersky is not, nor ever will be, providing backdoor services for the FBI.
This is Fake News, as an honest reading of the SEC press release shows. There is no such thing as an "SEC-compliant ICO"; the SEC has made no such endorsement.

The SEC press release simply says that ICO instruments may be securities and therefore subject to the full gamut of SEC regulation.
These all exist, you just don't agree with them being reasonable:

Scala, Common Lisp, C++, D, Clojure, F#, OCaml, Kotlin, etc. Those could all count or not depending on your subjective opinion.

The truth is, it is difficult to create the perfect language, and any sufficiently complete language will always start to have part of it that suffer in exchange.
Predicate Dispatching: A Unified Theory of Dispatch (1998) [pdf]
To circle back to the original question (what's it like to work at mozilla), it is a pretty great place as long as you don't mind being the subject of uninformed and hostile comments such as the one above.
> so i try to work on things like a compiler and a real-time rendering engine

Even unfinished this sounds like a cut above the average entry level dev. Make sure these projects are on github or whatever so people can see the code, even unfinished, it's good to see the progression.

Apply for a dozen junior dev jobs and see what happens. You'll probably get a bunch of rejections, but if you can write coherently and talk clearly you've got a chance.

And even if you don't get one you will probably discover something about what it is you are missing that businesses want and you can work on that specifically.
My personal estimate (after 11 years of professional fullstack web development) is that about 80% of web development is doing some variations of CRUD screens. Create that CRUD app, publish it on github and let the possible employers know that you can do at least the 80% of the daily tasks. With a github repo and a project on your cv, you'll be in the top 5% candidates that don't have any work experience. There's a much bigger need in the market for devs who can do CRUD apps than for devs who can architect and implement rendering engines.

Change jobs. There are jobs that pay similarly to a bike messenger, or maybe even more, but are less demanding, like a night shift security agent at auto dealerships. You could even take your laptop with you and work on your projects.
I wish more people could see that if Damore is right about biological variation underpinning sex disparity in tech, this exposes an opportunity for women. In the absence of affirmative action, women who pursue engineering roles will reveal themselves as having above average interest in tech—not only above women generally, but above men too.

My evidence is anecdotal, but it's strong. I first noticed this after months of teaching at a coding school, but I found, with cohort after cohort, women reliably outperform the men. Note they're dramatically underrepresented (15 to 1). The interesting thing is that whatever the reason for their underrepresentation—be it oppression or biology, or a mix of the two—these women self-select into an elite group by braving a predominantly male environment. Odds are they're good at programming.

My point is that if you belong to a minority in a competitive environment, it's important to consider the upsides too, in addition to the real and steep obstacles.
4 ICO’s Investors Need to Watch for Fall 2017
But you wouldn't be using both hard drives at the same time. You put one in a safe (place) and only take it out for the occasional setup, maybe swap them every couple months.
The crypto revolution is gaining pace, not 1 month ago the total market cap of cryptos was under 100 billion dollars USD now its 144 billion dollars USD. Whoever said that ICOs are bad for crypto was WRONG!
I still churn out 100% of my code and blog entries in TextMate 2. I've been using TextMate since 2006 and nothing else just "feels" as good.
That's actually a fairly weak rebuttal.

If the government is acting in a way you don't like, making a substantial presence known and credibly presenting a large set of allies is useful. Though that need not be an armed response.

Case in point from today's headlines: In Durham, NC, a large group of citizens presented themselves as having torn down Slaver Rebellion statues in the city. Something of an "I am Spartacus" moment.

(Though that original example ended poorly.)
Of course we should. I'd also prefer that the code/firmware was open as well.

I would hope there are specific requirements in the spec/standard WRT protecting the keys and such but I haven't checked to see if that's the case.

Yubico is, according to their website, working towards FIPS 140-2 validation for at least a few of their devices if that has any value to you (no idea about any of the others).
Yup, haircuts given by mother or sister and then even after a little money, trying to give yourself a haircut. Not knowing how to ask for a haircut.

Travel circumscribed by how far you can walk.

Being ashamed that your mother sewed up holes in her clothes.

Holes in the ceiling with water coming out of them.

No health insurance.

Being lucky to take one bath a week. Giving yourself washcloth baths.

Saving water by flushing the toilet with saved bath water.
A memo published by a law office is not a "legal opinion" in the normal vernacular.
> I do wish it was easier to load (SSL/TLS) certificates on them

What do you mean by "easier"? Yubico PIV manager is super simple to use. Of course you have to generate the certificate with OpenSSL yourself but that's part of the process. And the PIV certificates are automatically seen by OS. I'm using them in browser, git can be switched to use system certificate store effectively having hardware protected access to repos. SSH can also use them either via OpenSC or Putty CAC (depending on your OS). I've done that and it works, it's not much harder than the OpenPGP setup.
Hi,
I'm current maintainer of Wekan.

Wekan has API and Outgoing Webhooks, but they are different than Trello:

https://github.com/wekan/wekan/wiki/Features#api

Is it possible to use Trello extensions and integrate them with only Trello API ? And is it allowed to use Trello extensions outside Trello ? Or would they require separate integration to Wekan ?

For example on Trello templates can not be used outside Trello:

https://trello.com/inspiration

For general integration (similar to Zapier) there is plan to use Open Source tool Huginn:

https://github.com/wekan/wekan/issues/1160

https://github.com/huginn/huginn
Ha. It's funny that it's gone now. I read it just after I posted my comment. That's just a coincidence.. right?

Also, the first two years at an engineering school is awful by definition. Generally by then you learn to a) prioritize, b) take the right combo of classes, or c) go somewhere else. I opted for a & b but many friends and smart people opted for c.
> Hostility is, by its very nature, a violent attack on a person or group.

Remember reading about how what Damore wrote was "violence". Wonder what those who suffered from physical violence such as rape think when "violence" is used in such a context...

Then in general it seems like firing him was admitting defeat. Google could have responded by compiling a set of studies to disprove what they claimed were obviously wrong and misguided ideas. Surely they have enough people who know how to compile a research survey.

At the same time I bet Damore knew that this was going to lead to termination. He forced their hand publicly and they responded as any beaurocracy would be expected. There was basically 0 chance they would have said "oh thanks for the research and suggestions we will review and redesign some of our policies after you've publicly shamed us".

It seemed to them on the surface they won that battle but at the same time the admitted defeat too. It is a bit like someone responding to an argument where peer reviewed research is presented with "well, your mom is fat and you're stupid". That ends the argument, for sure, and the person saying it feels they've won the argument. But everyone else sees it as admitting defeat more or less.

The more interesting thing I found was that some "news" outlets like Gizmodo, chose to publish the letter but omitted the research. That seems strange. If one didn't know any better, they might assume they secretly agreed with the points made and did everything they could to promote them further. Few things work as well as deliberate and obvious censorship to make people pay attention.
Must be a very fresh father to be blind to the primary computing needs of this child: gaming.
Just because I show a level of consideration to the person behind of me that I'm not personally afforded doesn't mean that this is part of the issue. The issue is a design problem created by the airline, and I'd rather be courteous to the person behind me if possible.
> There is no way new compiler can be 100% compatible. Hopefully it will be tested on major projects, or there will be some official Scala Language spec.

I, for one, think that an official language spec would do the language a lot of good. As it stands, it is sometimes difficult to separate bugs from features in scalac...
That is exact reason I negotiated "work from home whenever you want" with the employer. It was either I quit because I could not stand random daily useless noise and chatter of the office or I can work from home and be more productive.
Project Management for Humans – Helping People Get Things Done
Heh yeah this is typical Chris. Excited that he might code again. Him and ErrTheBlog were such a huge asset to the early Rails community. Also if it weren't for Chris and his vision, we'd still be using Subversion. I remember him trying to convince me to switch to git. I told him that it needed to be 10x better than SVN. Git by itself wasn't, but Github was. Github was to git what Rails was to Ruby.
> Been too lazy to find an alternative

VeraCrypt is basically a fork of TrueCrypt
Without Prop 13, if you were paying the taxes you actually "should" on the true market value of your house, you would most likely be forced to move out of your current house.

If that happened to enough people, prices would stabilize closer to reality.
Presumably, the AV suite would send "telemetry" and related "data" to their servers for analysis...

"Microsoft Wins Appeal on Overseas Data Searches"
https://www.nytimes.com/2016/07/15/technology/microsoft-wins...

[edit]https://www.mcafee.com/us/resources/solution-briefs/sb-quart...
I guess not, unless the attacker controls the web browser, and then all bets are off.

The point of U2F is to avoid trusting the system, including the browser. Otherwise, what's the point over using just a password manager?
It's a double-blind study. The people conducting the study should not know who is in which group. They should be randomly administering either a probiotic or an identical looking placebo.
I've never met the guy but have a ton of respect for his work - his open source projects like Resque and pjax were awesome for their time. I imagine GitHub has benefited a lot from having real coders at the helm for so long.
Cast it as a reinforcement learning problem: you produce a candidate decompilation, try to compile it, and score it based on the similarity to the initial binary.
And this:

> we’re working around the clock

Why are they working around the clock? It sounds like they are running late and/or don't know what they are doing.
Unfortunately they are basically unusable on Android. Only Yubikey NEO has NFC interface and others cannot be used even by USB-C/OTG interface. The support would have to be implemented in Google Authenticator but it seems they are not interested in it.
Maybe it shouldn't be within her rights, is all I'm saying. The airlines could fix this easily. If the seats didn't decline, then there wouldn't be an issue. This is only an issue because they were designed in a way that allowed for such reclining.

It's a bad design choice with such limited space to add functionality that complicates an already tenuous situation.

This forum is one that frequently discusses issues of inefficiency and good design. How is it that these seats, specifically their unnecessary ability to decline, aren't seen as an example of bad design? Very few seating options need reclining capabilities, especially on short flights.
I don't know if CDisplay would count for me. It still is my preferred choice for manga & comics on PC, but for the last couple of years I used PerfectViewer on my tablet for that.
https://en.wikipedia.org/wiki/SCO/Linux_controversies
OK, so we're re-litigating the paradox of tolerance. (https://en.wikipedia.org/wiki/Paradox_of_tolerance)

Let's figure out where the line is for you.

Do you believe Al Qaeda should be able to obtain permits and police protection to hold rallies across the country to recruit people to their cause?
This is also known as the principle of charity:

https://en.wikipedia.org/wiki/Principle_of_charity
Show HN: Cloudformation dry-run is coming to Ansible
Competition. A lot of people generally like to harm their colleague's odds of success - they pass accountability, responsibility, work, force them to attend more meetings, force them to use more communication software. Basically trying to look good by making someone else look bad.

It would be very effective if everyone worked together towards a common goal. This really isn't an issue in fast growing companies but the slower the growth of a company is, the more destructive competition sinks in.
I don't have any issues with compile times. But I don't work on an underpowered Crapbook Pro.

If you are serious about your work and time than use serious hardware.

You don't see see F1 racers show up on race day with a Scooty Puff Jr..
Have you heard of Evil?

https://github.com/emacs-evil/evil

IMO - and I speak as someone who loves Emacs so much he has email, organisation, TODOs, calendaring, IRC, RSS and more in Emacs - vi actually does a better job of the mechanics of text editing.

Evil gives you the best of both worlds - the Emacs platform, and vi editing.
A much better place for such a tag IMHO is in the EXIF block. In fact, such a "copyright" EXIF tag already exists, but isn't commonly used or recognized on the web. Verifiability question remains though.

I wonder if some kind of a decentralized system could be made to automatically register published images, so that first registration could be reliably proven. Not that first publication equates to copyright, but that would solve part of the problem.
That was my problem first too, but you can make it require the token on mobile too. I have it set up that way and I need to tap my Yubikey NEO to authenticate using NFC on Android. Works great.
> Scott Alexander has a pretty good one in the link referenced in the post.

I must have missed where he proposes a model. By all means point that out. Specifically one that can predict how many women should work at Google in California, and in Boulder, and in New York, and in London, and in Mumbai... year by year.

> *But why spend time investigating when challenging the discrimination hypothesis can cost you your job, reputation, etc.

Challenging a hypothesis didn't cost Damore his job. Undermining his own colleagues by promoting negative stereotypes cost Damore his job. That was totally unnecessary to his argument... he could have just based it on CS graduate numbers and left the 'biology' out of it.
It's an abuse of HN to use it primarily for ideological battle, which you've been doing for months now. This is destructive of what the site is for—and so is the inevitably attendant incivility—regardless of how correct your underlying points are. We ban accounts that do this, so would you please stop? A flamewar about Nazis vs. communists is a sort of reductio ad absurdum on the internet.

(No, this is not because we're secretly Nazis or communists.)
My next read. Anyone read it already? What are the thoughts?
Air travel is incredibly harmful wrt global warming, so anything that disincentivises flying & lessens passanger-mile impact is a positive change from an utilitarian POV.
Alt-social network raises $1M amid Silicon Valley crackdown
> Sharp for some reason refuses to sell their smartphones outside of Japan.

Patents and different cellular bands (meaning radical antennae design).
Razborov casts doubt on Blum's P ≠ NP
Tup is really great. I wish it were more widely used. Tup can effortlessly handle a lot of situations that Make chokes on or requires deep magic to get right. A good example is the clean handling of automatically generated header files. This is all it takes to integrate protobufs into a Tupfile:

: foreach *.proto |> !protoc |> %g.pb.cc | %g.pb.h
: foreach *.pb.cc | *.pb.h |> !cpp |> %g.pb.o

The "|>" is the pipe operator and I've elided the definitions of the "!protoc" and "!cpp" macros (but they're about what you'd expect). Tup detects whenever a .proto file is changed and does the right thing. Getting this to work with Make requires advanced tricks like .PHONY and .PRECIOUS.
No headphone jack!

NEXT...
Besides, they don't give any more software update guarantee then Google's flagships are giving (previously Nexus phones, and now Pixel) - i.e. 2 years.
Snakemake – A make-like workflow management system using python