skysight-inc/HackerNews huggingface dataset:
I completely agree about having a dedicated team, and I'd expect a company of their nature to be at the forefront of security best practices.

I just checked some Equifax domains against SSL Labs, and while their Canadian site (https://www.econsumer.equifax.ca) scores an A-, it has no forward secrecy. I'm surprised to see a modern web server not supporting FS today. Worse, the main entry point to their Canadian site (http://www.consumer.equifax.ca) as indexed by Google does not redirect to a TLS enabled page, although they do seem to have a TLS endpoint for that domain -- but not sure how people are expected to get to it.

Edited to add: The first link is only accessible through a redirect by clicking on the "Get Started" button on their main Canadian site. Furthermore, even selecting Canada from the drop-down on https://www.equifax.com/personal/ redirects to the insecure non-TLS site.
I like how it simplifies state updates using actions and auto injects previous state. This is huge since it allows the framework to control the lifecycle of state instead of having to maintain this.state and let anybody read it at ANY time
Whats the fourth? I just know of Equifax, Experian, Transunion.
So you're gonna vote the corrupt billionaire instead.

Sanders doesn't need working class people?

You would rather vote for the party that is anti-union and just wants to slash taxes on the rich and get rid of as much regulation as they can?
They do it on purpose and have no intention of fixing their administrative inefficiencies. They know most people don't have the patience for this crap so that discourages people from creating a hassle for them with problem/things that they have to do.

For instance, in a past life I may call up to question a charge on my cable bill. Now that I have more money, I don't waste my time on such nonsense. If the cable company wants to charge me an extra $20 for no reason, they can do so, because it's not worth my time to call them up and get shuffled between departments for 2 hours.
From "The Demon-Haunted World" by Carl Sagan:

> It is claimed by apologists for the Reagan administration that, whatever the exaggerations in capability, some of it intentional, SDI was responsible for the collapse of the Soviet Union. There is no serious evidence in support of this contention. Andrei Sakharov, Yevgeny Velikhov, Roald Sagdeev, and other scientists who advised President Mikhail Gorbachev made it clear that if the United States really went ahead with a Star Wars programme, the safest and cheapest Soviet response would be merely to augment its existing arsenal of nuclear weapons and delivery systems. In this way Star Wars could have increased, not decreased, the peril of thermonuclear war. At any rate, Soviet expenditures on space-based defences against American nuclear missiles were comparatively paltry, hardly of a magnitude to trigger a collapse of the Soviet economy. The fall of the USSR has much more to do with the failure of the command economy, growing awareness of the standard of living in the west, widespread disaffection from a moribund Communist ideology, and - although he did not intend such an
outcome - Gorbachev's promotion of glasnost, or openness.
Ten thousand American scientists and engineers publicly
pledged they would not work on Star Wars or accept money from the SDI organization. This provides an example of widespread and courageous non-cooperation by scientists (at some conceivable personal cost) with a democratic government that had, temporarily at least, lost its way.

* I know Sagan isn't exactly a historian, but I'll choose his assessment of space war technology over other people's.
What's really interesting is how they designed their reward function. At the end of each chat the user can give each conversation a rating. The bot then tries to achieve a higher level of human interaction satisfaction, neat!
Did they have a specific reason for screwing you over? It just seems like a lot of effort to go through on their part with no tangible benefit. Sorry if this is too personal a question.
> 4. Establish security layers. It is good software engineering practice to have individually secured layers behind a public-facing presentation layer

What are your best sources/tutorials explaining the perfect server architecture setup which address this point?
Again, try applying your logic to the real world example I give.

Take Uber in Florida. Many counties they operated (knowingly/willfully) illegally. They recruited drivers from counties where it was legal to counties it was illegal, paying bonuses to drivers to get them to comply. They ran software that would cancel rides if it determined: a. It was a LE operation; or b. The driver was working with LE. Uber created training materials to avoid LE in counties drivers were operating illegally and distributed them to said drivers (everything from have passengers sit up front, take your Uber phone down, etc...). Driver caught breaking the law more than twice are terminated.

Millions in fines to drivers, cars impounded, drivers arrested and charged criminally...but nothing happened to Uber, how is that a middle ground?
Equifax's post-breach security is still horrendous
Just directing it at Equifax is much too narrow, though. At the very, very least some legislation should come out of this mandating that ALL credit bureaus should allow credit freezes, at any time, for free.

The thing that really incenses me about this whole debacle is the system is designed to benefit from its own incompetence! All these "identity theft solutions" that the big credit bureaus provide are just a way to charge consumers more for a problem that the consumer had nothing to do with in the first place!
The Corpus Christi Prime
As a HN reader i'm shocked by the number of downvotes my post recieved. Articles with the title Safari is the New IE routinely recieve dozens of upvotes.

Maybe some Apple devs downvoted my post :-)
That's not a backward-compatible change. Branches that now take either the then or the else branch will take no branch instead. Obviously, that would change the meaning of many programs in ways the author didn't intend by not executing the code in those branches.
I fixed his bug by changing the height on panel from 100% to 100vh. No need for extra markup like his fix plus as someone else mention iOS 11 doesn't have this problem and that most likely means the next desktop version will that fix also.
Apple did it for sole reason being 100% business decision.

1) Sell more MFi licensing since they will earn more per end product made for iPhones. Whereas with the 3.5mm they won't get any source of sustained income.

2) Sell more of their Music equipment after they bought beats. AirPods and Beats wireless with W1.

3) For users wishing to keep using their existing headsets, theirs potential revenues on replacement dongles.

4) The iOS lock that Apple has is a death grip, Many people will adopt to the technology whatever Apple does, be it either the simplicity of the OS or the Apple ecosystem populace which will help them make the Analog open standard close and earn through more and more of their proprietary interfaces. A DRM control mechanism making the product more steered towards Apple in holding control over the end user.

This is a move by apple to drive these other areas of business and improve revenues outside of the iPhone category.

Does removing the headphone jack give them 100% control? No. But it helps push enough people to spend money on things that Apple will directly benefit from additional revenues.
That is because Safari's feature support is the lowest common denominator of the other browsers. By developing on it you are ensuring you don't use features every other browser but Safari supports.
Welcome to capitalist America!
This title is patently false. After entering my information in the Equifax incident site, the site claimed that I and my mother were "potentially impacted". However, both my aunt and cousin were NOT "potentially impacted."

While my single experience qualifies as an anecdote, I nullifies this idiotic headline.
If that was the case, it would be well-known because banks would not be able to get Equifax credit reports on consumers.
I read on Krebs on Security [1] that those who visited the site from a computer got one result, but also got the other when they visited from a mobile phone. Not that this might apply to you, but the results from the equifaxsecurity2017 site do not seem trustable.

Quote from the article:

> In the early hours after the breach announcement, the site was being flagged by various browsers as a phishing threat. In some cases, people visiting the site were told they were not affected, only to find they received a different answer when they checked the site with the same information on their mobile phones.

[1]: https://gixtools.net/2017/09/equifax-breach-response-turns-d...
This is a "too big to fail" event. Getting rid of or changing Equifax would disrupt too many other businesses, therefore any wrongdoing of theirs will be waived away and the costs pushed onto consumers.

Equifax were already in the process of having the law rewritten in their favour by the Republican party, at least that might be derailed or delayed for a few years. https://www.americanbanker.com/news/equifax-breach-may-kill-...

There's some claims here about the history of Equifax as a form of legal redlining, but they're a bit hard to substantiate with simple googling: https://twitter.com/matthewstoller/status/906257077215133696
"Guix...uses the Nix daemon" and "to extend the reach of Scheme to the daemon" are incompatible and I hope you see why. Patches aren't flowing from Guix to Nix, or if they are, nobody's talking about it and the patches aren't showing up on anybody's radar.

The wimpiness of the Nix language is a virtue. There is no call/cc. There's no ports, and indeed networking is tamed. The language is just barely powerful enough to do its job, and community members have found it somewhere between intractable and impossible to build compilers, text processors, etc. in Nix itself.

String interpolation is a fitting punishment for our decision to continue to use Unix-styled systems; our systems think in bytes and communicate in bytes, and I see no reason why we should walk away from our highly-developed long-standing relationship with bytestrings as long as we are still on Unix. (You will say something beautiful about Scheme. I am busy looking ahead to capability-aware languages; Nix is a scaffold and nothing else.)
Safari is not as bad as IE was compared to other browsers. However, calling it the 'new IE' is accurate if the definition is 'the browser with the worst support of new features and most bugs'. Here is a comparison http://html5test.com/compare/browser/safari-10.2/ios-10.3/ed...

What is especially frustrating for web devs is that all browsers on iOS are Safari underneath. We have to deal with those weird bugs and missing features the same painful way we dealt with IE, hence the title of the article. Saying that it's not as bad is not the point, IE 11 was also not as bad as IE6, we still had to deal with its quirks.
Yet another argument for decentralization. Data monopolies have single points of failure.
https://en.wikipedia.org/wiki/Arthur_Andersen#Enron_scandal
Does anyone know what I can do as an US citizen abroad to protect myself now? I tried to get a free copy of my credit report but it required a us address to process. I tried to set up an account to freeze my credit but those require a us address as well.
Do you realize that Scott Adams was an avid Trump supporter during the election campaign? You might want to catch up with him.
Oh right, of course few years old android phones can still be updated officially (-> by the average user, too), being way better this way.
Could you cover the topic of SegWit? Since Bitcoin core has adopted that as their first scaling code change post 1MB blocks, I think it would be helpful to understand what's going on with that.
For the observation toward the end that compressed files seem highly uniform, this makes sense intuitively. If there were any visible patterns, that would imply that the data is further compressible, which would mean the compressor didn't do it's job very well.
I would want a Lisp VCS to preserve comments, which are not usually present in the deserialized form of "Lisp source code", so I don't really think your description helps here.

I haven't used Xerox Lisp enough to remember whether the Common Lisp side did keep comments in a similar way to InterLisp-D.
Agreed.

Saying Safari is the new IE is like saying Trump is the new Hitler.

Not even close.

Just no.
They do it now. Typically businesses only report credit information to one of the bureaus. They exchange information with each other so information eventually makes it around to all three.
This is great advice for writing professional demand letters in general, beyond just identity theft-related.
What can you do when the businesses own the lawmakers? Outside of violence I'm not sure exactly who has the power to get justice here.

I honestly think that criminally they are going to get a slap on the wrist if anything. The majority of damages will come from civil suits.
It doesn't really exist. You "can't" because some computer still needs access to the data.

You can do layered security, but how? Think about a customer service rep. They need access to ~everybody's data at a moment's notice because they're a CS rep. That's what they do. That means every CS rep machine has access to all the data.

I'm not sure this is solvable. SSN's are the problem, not the way that we store SSNs. They still need you to read off your SSN when you call in, so you can't just encrypt it.

Think about Equifax in particular. They're a credit bureau. Of course they need all the data available all the time -- that's what a credit bureau does. The question is, how would you partition the data so that a failure in one place wouldn't lead to exfiltrating all the data everywhere?

The trouble is, it wasn't just "they popped Struts and then ran an scp." Even if you partition the data, they popped Struts! They have RCE inside your network. It's absurdly easy to pivot from one machine to another in a given network. You keep a helpful ~/.bash_history file that says exactly what's important and where everything is installed. Stuff like this is why I argued for deleting it, since it was the #1 most helpful tool I had that helped me pivot inside a target network. But then you get people yelling about taking away their bash history.

You can imagine how terrible this problem becomes in practice. Nobody here gives a crap about Equifax; they just want their heads to roll. Unfortunately you'll be next on the chopping block because no one has solved these issues. As soon as the world goes crazy over the lack of security, it's game over for us all because it leads to a highly regulated world that won't be much safer.

See how resistant we all were to the mere mention of increasing security procedures: https://news.ycombinator.com/item?id=14104156

I was snarky in that thread which certainly didn't help, but you have an uphill battle if you want to implement anything on a large scale.
Unless of course you're referring to ES6 support, in which case it has the best support.
Perhaps they were trying to do that, but after New York Attorney General mentioned that this can not be enforced, they updated their FAQ that this waiving is only for issues regarding to the service itself, it does not cover the data breach. So you should be ok, but frankly in this case the service is useless, it is only for one year, but the information is still valid after that. The minimum they should do is to remove all the fees for freezing/thawing the account and allow everyone to permanent freeze their accounts with ability to unfreeze whenever they need to open a new account.

The sad thing is that they think the current solution is adequate. They do it this way because we are not their customers, we are their product. I would encourage to complain about this to your representatives. We could have much better protections about identity theft, have account frozen by default and without any fees. Have their credit checking services available for free.

Sadly, the business is structured so they actually are making money when it is easy to open a credit line, even illegitimate one.
Not true. It said 'not impacted' when entered fake account and 'impacted' when I typed mine.
So were the robosigners, and some of them eventually (years later) got fines: http://www.marketwatch.com/story/us-breaks-down-93-bln-robo-...
How is a baby boomer that can barely attach an image to an e-mail in touch with anything in the modern world?
Luckily, it doesn't have near the numbers IE 6 ever had and it's not something a company would require their employees to use for work applications long after EOL, that was the real pain of IE.
I'm just going with the fraud alert (free) for now. Maybe it's moot, but it's really tough for me to justify giving all three companies money due to something like this.
What are some cute things that beginner programmers do?
> "How Jerry Pournelle got kicked off the ARPANET"

One of us.
You're probably right, I only have to deal with CSS inconsistencies since JS tooling largely solves that problem for me these days. Unfortunately tools like CSS prefixer can't solve for everything.
A history of regular payments on a card with a $100 limit doesn't require you to go into debt in any way except for an accident of nomenclature. Pay your $5 every month; you'll have normal credit and no carried debt.
They said that after New York Attorney General complained that this is not enforceable. I'm pretty sure they were hoping it would stick.
If I tell someone "my nose may be touched" then I'm allowing them to touch my nose.

If I tell someone "this call may be recorded", then surely I'm giving them permission to record the call. Their ability to detect my lies seems to be a reasonable "quality" purpose.
> we're far less effective at turning that anger into change

The anger will become a mob that enacts change when a critical mass of people lose access to food and/or shelter.

> what of [Occupy]

Occupy was very successful at (re-)introducing class warfare into the public dialog.

> First, that people are naïve, and second, what's it going to take to drive people to take un-ignorable action?

3rd, why isn't this anger organizing into larger activist/political movements? Well, with enough surveillance data and modern data analysis tools it's easy to find the "leaders" or "organizers" that bring people together. Remember JTRIG[1]?

[1] https://theintercept.com/2014/02/24/jtrig-manipulation/
Privacy. Not wanting to encourage Google's monopoly positions any more than I wanted to encourage Microsoft's back in the bad old IE6 days. Inertia.

But yeah, I'm disappointed they're changing the UI to one I dislike, and at the same time removing the ability to customize it. Kind of fuming about that, actually.

But the alternative will be to stay on a browser that won't get any updates, and gets left behind by websites using newer features, and hacked when it doesn't get security updates.

Maybe some enterprising open source developer will find a way to hack the Servo rendering engine into a different browser chrome UI - just as Firefox (then Phoenix) did with Gecko back when the Mozilla suite was dying.
Yes. Perhaps the voting currency should be hours, not dollars. Make the first vote free. But N-1 more votes costs you N^2-1 hours from your "registered community service" account maintained by the government. No overdrafts allowed: the hours must be credited before they can be debited.
I wouldn't think that an RFC would have to come before hacking out a prototype. In fact, doing a prototype is probably a great way of preparing for writing an RFC.
Not just the EU regulators.

The US antitrust lawsuit was also about using their desktop OS marketshare, and the bundling of IE with said OS, to drive companies towards using IIS at the server end.

Damn it, Microsoft basically coined the expression "Embrace, Extended, Extinguish". Meaning that they embrace some standard, then extend it with MS specific behavior, then extinguish the original standard via creeping incompatibilities.
It's a very long story, but my business partner was running everything by the time they came into the picture and so their allegiance was to him. We had a personal falling out and based upon that he became hellbent on ensuring I got nothing once it was clear that the acquisition was going to happen. It was easier and cheaper for Equifax to take the position they took. If I were a corporate lawyer, I likely would have given Equifax the same advice. That doesn't make it right though.
"Too many" of something is bad by definition, but it's not a "big problem" by definition.
Debit cards dont have the same protection as credit cards.
Of course not, that only contains public data breaches. Not only that but Equifax doesn't keep usernames and emails, it's names, addresses, credit cards, etc.
I'm spending the money anyway. Don't see the issue in this case.
That's not my point.

Thread says "Safari is holding the web back". Parents answers "Safari created the tools that lead to big parts of the modern web".

My answer is: so did IE 5/6. That doesn't mean after a while and for a long time they weren't holding the web back, it's a side fact that has no relevance.
Speech-To-Text Platform Heralds Power Shift of Blockchain Technology
football has always seemed like an outlier to me, in the sense that the overwhelming majority of adults I know watch and enjoy it but I know almost no one who played an organized version of it. Anecdotally, this doesn't seem to work the same way as other sports. It really is a sport made for television and gambling, which will probably continue to drive it for a very long time.
Yeah, I should have said it was syntactically backwards compatible. It's obviously not semantically backwards compatible.
And they have still, as far as I can tell, not communicated to anyone who the Canadian and UK affected people are; they've merely stated that there are some…
This has been food for thought for me. I'm currently part of an engineering team that's a small part of a non-engineering department, with all the disjuncture between management and coal-face workers that situation always brings, and then some. I think I may be proposing something RFC based on Monday.
Every attorney here in the Federal bar needs to file an emergency injunction on Monday asking the US Government cease sharing confidential bank data with Equifax until they are paid statutory damages, and Equifax posts bond large enough to cover any future data breach payout.
The whole situation is reasonably well explained by CGP Grey's video on Social Security Cards

https://www.youtube.com/watch?v=Erp8IAUouus
You'll have to provide some more details. Why would you want this broken type coercion? What are you actually trying to do here?

But in the absence of this information, my first guess would be:

if (foo.bar.length >= baz.buz) {
...
} otherwise {
alert("Something unexpected happened. Either foo.bar.length or baz.buz is not a number.")
}
I'd say FB is way different than the discipline to not over spend on CCs in a community like this. Not over spending on CCs being far easier.