skysight-inc/HackerNews huggingface dataset:
There was plenty of awful Soviet tech, too - this thing has survived because it had some value, was well built and taken care of but you don't hear about the thousands of pieces of tech that were shoddily made cheap crap (though expensive for a Soviet citizen) and wouldn't last a year without repairs.

Soviet tech had to be built for serviceability - people couldn't often afford new things and even if they had the money, there was no guarantee it was even available. And many things just broke down constantly. It even went so far that "a set of golden hands," meaning one could fix a lot of stuff was a valued characteristic in males, and women sometimes may have overlooked other personality flaws in a relationship because of it, like drinking.

My grandma had a Soviet TV well into the 90s and even early 2000s, maybe out of sentimental attachment more than anything else. The thing broke down constantly, every 3-4 months at least, and she'd always call a repairman. In the end I think more money was sunk into it than a brand new 4K TV would cost now. It was finally laid to rest when her usual TV repairman died, and the new one found it increasingly difficult to find replacement parts, and finally gave up, and we could at last get her a new TV.
*adds operational expense without a counterparty willing to pay for that expense

Those with data on Equifax's servers aren't Equifax's customers, so other than "not having a PR cluster&#@_" economic incentives are not aligned to prevent this.
Disagree. I think the examples in the grandparent comment are spot on.

You can be cynical of the government and the regulators and still do something about it. If you are a landlord and running a credit check don't use Equifax. Maybe this will open the door for startup in the space.
The reaction here seems pretty over the top to me. Leaking a bunch of private information is bad, I guess. As a former federal employee, my SSN/etc. were leaked in the OPM breach a couple of years ago. So far, it’s hard zero repercussions for me (or anybody else I know). There are many layers of defense mechanisms in place. It’s not like just having some numbers let’s you do whatever you want. The US banking system has a ton of human checks and balances and ways to reverse things in place. If I ever saw an unusual charge on my credit cards, I’d just get it refunded. How much actual harm is going to come out of this? My suspicion is not that much.
Stuff to Do to Register in Heat of the Code by FOSSASIA
American politics is driven by anger. Unfortunately, anger at "elites" and "immigrants" far outweighs any kind of desire for competence or real solutions, which is why you have Trump.

There is an entire industry keen to get people unconstructively angry about unrealistic threats so they can sell gold and ammunition.
The formula you give for variance is the sample variance, with N - 1 as the divisor. It gives an unbiased estimate of the variance of a population, assuming X is a sample of that much larger population.

However, by default numpy gives you population variance, with N as the divisor. This assumes X is the entire population, which is different from R and Matlab.

As a result, the answer in your code is different from the formula just above it.

np.var(X)

gives 207, while

np.sum((np.array(X) - np.mean(X))**2) / (len(X) - 1)

gives 236. If you want the N-1 corrected sample variance from numpy you'd use

np.var(X, ddof=1)
Equifax security freeze PINs are the timestamp of when you request the freeze
If anything, these journalist are incredibly misinformed and shallowly invested in the issue (they do love clicks though). There's not a sentence about the power usage of browsers, performance on mobile browsers, the mass amount of APIs that have been added over the past few years, the evolution of JavaScript that is happening in tandem with new features that are being released, not even a sentence about how these APIs are extremely immature and still a WIP; all things that if taken in perspective will highlight the nuances of Safari's strategy of slow adoption.

Apple could make a browser that has all these features (where APIs are slow to being adopted on sites that users most use, low impact) or they could keep investing in iOS (where APIs are mass adopted from day one on apps used by hundreds of millions, high impact).
Normalized by usage I would be surprised if it's actually as high as you suggest. The more popular a platform is, the more attention from bad actors there will be. Every platform has had similar vulnerabilities along the way.

For example:

https://www.google.com/search?q=rails+rce&ie=UTF-8&oe=UTF-8&...
Hi there,

the code for the example is just ~100 LOC - it's a showcase of a library called "Iroh", which brings dynamic code analysis to the whole ES5 syntax. If you're wondering what the essence behind the example is, then I really recommend to give these links a try:

Github: https://github.com/maierfelix/Iroh

More examples: https://maierfelix.github.io/Iroh/examples/index.html

Cheers!
It's a little bit confusing that the article defines variance as "the averaged squared deviation of each data from your dataset" but then the formula shown is the unbiased estimation of the variance (with n-1 in the denominator) without explanation.
Totally.

Anecdotally, though, a) firefox diverges further from chrome than safari does and b) the types of CSS flaws don't wven approach the black magic of designing for IE6.
Wouldn't an extension like HTTPS Everywhere do it for you? (Provided you're savvy enough to have it installed; in other words, they should still put in that redirection...)

https://www.eff.org/https-everywhere
Wow, that's a crazy story. You would expect CD Baby had some leverage in all of this. iTunes needed their songs to some extent.

> People had been criticizing iTunes for having less music than the competition. They had 400,000 songs while Rhapsody and Napster had over 2 million songs. (Over 500,000 of those were from CD Baby.)
My understanding was that people who used their credit report service got affected. Perhaps after you froze you did not have a need to use it.
I've got HTTPS Everywhere running and it doesn't appear to have a rule since I'm still hitting the non-TLS site.
This article barely makes a point for itself. Why is this on HN?
Driver Genius Pro 17 Crack with License Code Free Download
How one can talk about earthquakes without mentioning plate tectonics [1] is baffling to me. It is a completely coherent theory on how geology works and the last real paradigm shift in the sciences. On the order of Newton with his laws of motion for physics. Or the atomic theory of matter for understanding chemistry.

In brief and simplifying:

Relative to each other, the Pacific plate is moving to the northeast and the North American plate to the southwest (absolute motion is a bit different) and a fairly constant rate of about 25cm per year. Being solid rock these plates don't slide past each other continuously (except in a few rare places) but build up stress over time near the contact between the two plates (fault). When the stress is high enough, the fault breaks loose at a single location and propagates a distance from there. How far the break propagates and how much the plates move relative to each other determines the size of the earthquake.

How plates move on the large scale relative to each other changes on the million year timescale, so on the 10,000 yr timescale, where you will have about 50-100 ~7.5 to 8.0 magnitude earthquakes on the San Andreas under San Francisco, the mean frequency and standard deviation of earthquakes won't change much. Geologist can determine when large past earthquakes occurred by digging trenches through faults and looking at the physical displacement of sediments [2].

How to predict earthquakes by better than 30% chance in the next 30 years (this is the current best estimate for the Hayward fault near where I live) is on-going and with no success so far. Looking at changes in ground conductivity some weeks and days before an earthquake is the most promising path at the moment, but has not yet been proven to work.

[1] https://en.wikipedia.org/wiki/Plate_tectonics
[2] https://earthquake.usgs.gov/learn/topics/safz-paleo/
This just looks like classic digital four horseman bullshit.
They're all Safari underneath.
> We have as a society chosen to trade the security of our personal information for greater and cheaper access to products and services.

Agree, and it's one of the reasons I generally try to avoid using products that are low-cost or free (the other reason being questionable sustainability, regardless of funding). At some point, products need to break even or they will go out of business. As a customer, you are always paying for the product in some form or another. For something that's free, you might be paying with your personal information now... or later if running on a low budget has caused the product developer to cut some corners when it comes to infosec.
An RFC doesn't have to be huge. Even one that becomes huge doesn't have to start that way, and probably won't. As the article points out, intra-organisation work isn't the kicker here in itself - inter-department work is where the concept has merit.
PCI anyone?
I do wonder if America will see some kind of Red Brigades armed political group in the coming decade. There's already an extensive armed rightwing political movement.
> If I ever saw an unusual charge on my credit cards, I’d just get it refunded. How much actual harm is going to come out of this? My suspicion is not that much.

Fraudulent charges on an existing account is not the concern when someone has your SSN and other high-value information - it's the ability for someone else to open an account in your name that you have no knowledge of.
I fixed this issue.
> "want to avoid deflation"

Not necessarily desired. Deflation gets a bad rap, but on the positive side it does encourage sensible economic behavior such as saving and avoid of wasteful spending.

> "need a supply of money that grow at least as much as total wealth...That's why gold-based currency are now considered a bad idea (and crypto..."

Well there is no requirement to limit the money supply to one currency...
This is not a fix, on mobile 100vh and 100% are different due to the auto-hiding address bar.
A common pentest isn't geared towards discovering architectural weaknesses like all Americans PII is one popped webserver away from disclosure.

What's needed is an architectural security review, which is even rarer than people conducting an annual pentest.
On Hiding a Plaintext Length by Preencryption (2011) [pdf]
The results of a scan of equifaxsecurity2017.com by Mozilla's "Observatory" do not inspire confidence either:

https://observatory.mozilla.org/analyze.html?host=equifaxsec...
How do you do this from a technical perspective? I've tried to look for solutions to do this in the past but never found any good options.
The CFPB should definitely be added to the list of lawyer alternatives. I had a minor issue with a bank and filing a complaint with the CFPB got it quickly resolved whereas my state's consumer protection division didn't even bother writing back.
And vice-versa - in fact, I'd put a lot of faith in a prototype accompanied by an RFC. I think each would help to materialise the other.
How is this better than woof?

http://www.home.unix-ag.org/simon/woof.html
Floridians are in danger because the design of hurricane maps is flawed
Crushed concrete makes good concrete, but you'd still have to add sand.
very very cool. Too bad you have to be under 30. Are there grants for living expenses? I'd love to tell some younger students about this.
Ok we've sent the title above to Africa.
Working with Smalltalk is pretty cool. I sometimes say that the image-based part of Smalltalk is like Lisp, but done right, because the state of the code in your image and the state of the code in your source files can't ever get out of sync; the IDE is the image.

It's also quite interesting from a language design perspective. For example, the syntax is mega-minimal (it's called Small talk for a reason!). The syntax can be summed up as:

- A small handful of reserved words (self, true, false, nil, and one or two rarer cases that escape me ATM).

- Local variable declarations.

- Message calls on objects (what other languages usually call methods). Either unary calls "anObject unaryMethod" (a no-arg method), keyword calls "anObject withFoo: someObject withBar: anotherObject" (equivalent to anObject.method(foo, bar)", and binary calls "anObject + anotherObject" (single arg methods, written with infix syntax).

- A syntax for lambda closures, called blocks in Smalltalk "[:a :b | $code ]", basically equivalent to (lambda (a b) $code).

- Statements are terminated with a period.

- "^foo" returns foo from a method.

- The semi-colon is used for calling a sequence of methods on the same invocant (a better way to do fluent interfaces, basically).

From these pieces everything else is constructed. There's no reserved syntax for things like conditionals or loops. For example, a conditional works like this "condition ifTrue: [ $trueCode ] ifFalse: [ $falseCode ]" which is just plain Smalltalk. The implementation is simply that the Boolean type has two subclasses True and False, and the implementation of the ifTrue:ifFalse: method calls the true code in True and the false code in False. Dead simple! Loops and exception handling are done similarly by calling methods on blocks.
I don't think it's a stretch to read the comment as "Java EE has too many knobs and dials", which is very much not a tautology.

(Whether it's true or not is another matter, and not a point I'm qualified to argue)
I'm on GiffGaff which isn't one of those networks supported.

Additionally I think the rigamarole of getting to the station, connecting to the wifi, swiping back to the article you couldn't read, downloading it etc is a real pain!
ID-034 Faith Cosplay Grand Orgasm
The New Yorker wrote a much better article about this months ago: https://www.newyorker.com/magazine/2017/05/29/the-world-is-r...
It seems odd to extrapolate to the entire world's population of adults, yet rule out the possibility of living anywhere that houses cost less than a million dollars.
>both crazy and ingenious in one package.

wait until you see the NSA mud-pipe-tap.
> This is only going to get worse as newer iOS versions drop support for older hardware, especially iPads.

I don't think that it's fair to say it's going to get worse, in the sense that it's as bad as it's going to get right now.

And it's not too bad right now.

Apple is quite good about support for older devices. For example, iOS 11 supports 4-year-old devices, and that's even somewhat of a special case since it's dropping 32-bit support.

People use iOS devices older than 4 years old, but it's not a huge burden to keep a handful iOS 10 and iOS 9 devices around for development and testing. Certainly, it's a wonderland compared to testing on Android.
The worst case scenario is identity confusion resulting in getting someone else's criminal record: https://www.theguardian.com/us-news/2017/apr/03/identity-the...

(although that appears to be ordinary incompetence)
IE still holds the crown here. Lots of "enterprise" still use IE (not Edge), and IE have not got that much updates lately. That said I've had more issues with Safari then IE.
Crushing rocks down to sand is common. Here's the machinery.[1] The trick is to bang the rocks together. China seems to be making lots of sand for concrete. There are many manufacturers in China making rock crushers and sand-making machines.[2] China has plenty of mountain rock suitable for rock crushing.

Here's a marketing paper on making sand, and what to make for making concrete.[3]

[1] https://www.youtube.com/watch?v=1CpjRMICXNM
[2] https://www.alibaba.com/showroom/vsi-crusher.html
[3] http://www.metso.com/showroom/construction/new-type-of-crush...
neat resource, thanks
This is the thing that bites you. Someone opens a store credit card in your name, uses it enough to get the credit limit to a point where they can walk off with enough stuff to make it worthwhile. Guess who gets reported to the debt collectors? Not them, you do.

And here is the really sad bit, when you tell the debt collector that its a bogus account and not you, by law they have to stop hassling you but instead of 'retiring' the debt they just resell it to another debt collector to get back some of the money they paid for it. So the cycle doesn't stop.
Nice charts.

Just one idea, on your vegetable chart, you have onions as a red line and tomatoes as yellow. I would swap them around, as I automatically associate tomatoes with red.
For more than a decade, a debate has been going on in the Communications of the ACM (as well as other places, thats just where I've read of it most often). You can't make charges of negligence stick against companies using technology. There are no 'standard practices' they are negligent of following. If they were building a bridge, they would hire licensed certified engineers, and they would be legally bound to give those engineers access to the tools needed to do their job, the time needed to do the job correctly, and even if the CEO wanted to push the project forward despite misgivings of the engineers over safety, he would be legally forbidden to do so (and criminally personally culpable if he did).

The same is not true of software-driven systems. There are no licensed developers, no regulatory body determining what tools must be made available, no guarantee of primacy of technical engineering concerns over business management. If a software engineer says "it needs more testing" or even "there is a bug that will kill people" and the CEO says "ship it", it ships and the courts will do nothing. This was proven to be true even in cases where incompetent management results in bad software that gets people killed in the case against Toyota with their "unintended acceleration" due to a firmware bug that would have been caught immediately if the developers had static analysis tools.

Companies fight against the establishment of any sort of standards because it would reduce their profit margins. Developers fight against the establishment of any sort of standards because it would raise the barrier to entry in the field and no matter who the standards body consists of, they will select standards which people disagree with, they will be reluctant and slow to change or update them, etc. Both sides are right. But the alternative is companies having free reign up to and including incompetence of the degree which gets people killed with no accountability. People are overall very bad at decisions between two scenarios with clear negatives on both sides. They feel entitled to a 'clean' option and are uncomfortable with saying "I embrace the negatives and accept the burden of working hard to try to minimize their harm in order to gain the benefits of this option." Accepting the negatives implies taking some responsibility for bringing them to fruition and no one wants to be responsible for that - even if the alternative is worse. Not every decision is easy.
Step 1: Patch your shit.
SDI programs from the era that did not produce anything include the nuclear pumped X-Ray laser, which never worked at all. The shocking amount spent on that bullshit would have been enough to fund a huge amount of useful work in science, defense, or whatever.

The thing that's frustrating about that (aside from the fact that people are ignorant of such things, but still feel qualified to comment on the topic) is that plenty of people knew it was bullshit three decades ago. The sheer hypocrisy of the politics of SDI is almost unique in human history, considering how much money was wasted by people who claimed to be concerned about excessive government spending.
It's probably best to treat Equifax specially rather than making an example out of them for the rest of the industry to follow.
I don't know if the feature support chart paints the full picture. I think web developer's problem with Safari is more nuanced.
It's not so much about whether a feature is implemented or not, as is about 'how' it's implemented.
Science behind E-Commerce Checkout
Okay, so someone opens up a credit card in your name. They either use your address, and you notice because you get the correspondence, or they don't, and you have an easy way of disavowing any attempt at collection by showing the discrepancy in the address.

No doubt these layers of protection will fail for some people. Maybe Equifax should be required to set up a fund to pay out to such people. But it's not apocalyptic like people are making it out to be. OPM leaked the records of about 20 million people a few years ago. So far, there hasn't been any sort of mass-scale impact as a result of that breach.
Both TCO and PTC can decrease performance easily for a bunch of reasons. TC39 addressed this[0] when considering explicit tail call sites. Reasons vary from Windows ABI (Chakra) to something as simple as "now I have to figure out if this is really a PTC" -- and if your function has a PTC but that only gets invoked once, it's not hard to see how the extra analysis pressure doesn't weigh up to the elided stack frame. JS engines were already extremely optimized, it's not like you're taking a CS student's first lisp interpreter and adding TCO. (Fortunately, some of the litmus tests for whether you can apply PTC are encapsulated within strict mode, and the compiler stages definitely know that for free already.)

[0]: https://github.com/tc39/proposal-ptc-syntax#performance
This is a nice way to visualize the elm architecture, but of course it misses out on type safety and the compiler.
> Everybody can lock down a small network.

You're too optimistic :(
Is it worth the effort to design software well? (2007)
There are definitely methods of limiting the damage of a front end being taken over. A proper threat modeling process was obviously never performed.
it is not really.
now it is python3.X -m venv
which is still virtualenv but again a different implementation with different bugs
Since the big project is more interesting and didn't get much attention, we've changed the URL to that from https://maierfelix.github.io/Iroh/examples/type-checking/. We also adopted your title from https://news.ycombinator.com/item?id=15040182 as a way of fending off the title nitpicks re 'polymorphism'. (Submitted title was "JavaScript: Tracing Polymorphism at Runtime".)
It looks interesting, and might be something I introduce to my team.

Is it possible to define cohorts of users, and then expose features to that group? I work on a SaaS app used by businesses, so it'd be very handy to use this tool when a customer is beta testing a new feature.
I don't think Singapore is the best study in comparisons with the U.S. as it has quite explicitly managed to place high-restrictive control on its population in a way that would not fly (explicitly, anyway) in most Western nations. Singapore is hardly what Americans would consider to be a democracy or free society, and by a very very large stretch.
>NYC is stuck on a weird old-fashioned idea that French cuisine is the pinnacle of dining out.

How is this weird or old fashioned? French food is by far my favorite.
The demoscene is pretty much alive, here are some 2017 events.

http://www.assembly.org/summer17

https://2017.revision-party.net/

https://www.evoke.eu/2017/

https://nordlicht.demoparty.info/

http://outlinedemoparty.nl/

And some info about upcoming parties,

https://www.demoparty.net/

https://demozoo.org/
Casinos Aren’t Enough as Native Tribe Makes Deal on Drug Patents
If there was a centralized platform that allowed social networks on top of it with their own governance powers, could that curtail unwanted issues? Or would that central platform/body be breachable as well - if not, under what conditions would it be safe?