skysight-inc/HackerNews huggingface dataset:
Equifax is in the business of selling this information to other companies. They are offering services, which allow banks and other institutions to check this information through web service interfaces. It is kind of a core functionality that this information is available through a web server. More old fashioned way would have been to expose this information through some obscure protocol, but I don't think that would make it any more secure.

Now a different thing is that should this information be available through a server that is accessible directly through the Internet (and I don't know if it was) or if they should require for example a dedicated VPN connection.
Its disingenuous to imply that there is not an incredible amount of money pushing for "Climate Change" scenarios. The entire construct is to create carbon credit exchange (ie. Chicago Climate Exchange) which JP Morgan estimated to be potential $1.5T a year market.

Pretending that its honorable scientist on one side and medieval science-haters on the other is a childlike simplification.
"And you don't need to watch multi-millionaire football stars, pampered for most of their lives, ostentatiously disrespecting the American national anthem, kneeling, their raised fists in the air."

author's an a-hole
Guix may not manage software compilation, but it is passing parameters to the compilers used to handle compilation. So whilst its not a build system per se, it can be seen as part of the overall build infrastructure.

That said, my complaints about the complexity of build systems extend to package managers also, in that I don't see why they need to be as complex as they are. Part of me thinks it's because the tools lack sufficiently rich metadata to make their jobs easier, but otherwise I don't know what's causing it.

I have no issues with the use of Scheme in Guix (I'm learning Racket at the moment, no major complaints), and perhaps the abstractions will become simpler over time. I don't know enough about Guix to comment further on it. My comments were not aimed at Guix in particular anyway, but were general observations.
Here’s an irritating bug that popped on Safari 10.1 (iOS 10.3) that strains the use of CSS variables: You can’t just use a variable to declare a box-shadow’s color opacity, you need an intermediate variable.

Demo: https://codepen.io/anon/pen/YxmQdj

Apple versus Google keeping devices up-to-date is a reversed problem on the web: iOS’s web browser updates only with new OS releases, and they don’t come to all devices. iPhones 5 (and iPads 4) will be stuck with that bug forever. On Android you can use Chrome’s latest version if you’re on ≥ 4.1 and Firefox’s if you’re on 4.0. 99% of Android users are.

Even if you’re very aggressive on focusing only on recent browsers for your website, you need to handle Safari bugs for years.

Safari is far from being as bad as IE ≤ 8, but it sure is the most annoying browser when you’re targeting only recent ones.
Ask HN: What has been your experience with TopTal in 2016-2017?
Nice pictures, wouldn't have said anything, but your commentary was practically unreadable crap. You're trying far too hard. Get rid of all references, cringeworthy grammar, exclamations and do it in straight documentary style (which is what it should be) and it'll be informative and interesting.
Humans not taking the time to understand SQL properly is their own fault though. Three value logic works perfectly well in the right hands.

JavaScript is horrid :(
Maybe that, or maybe you have a large number of strategies for generating replies, and you can pick a good one ahead of time, so you don't need to do an exhaustive search.

Compare it to how a human chess player looks at several possible moves as opposed to a computer program which will consider thousands.
This just isn't true. With proper controls and an internal authentication stack you absolutely can guard against an edge getting owned.
One benefit is that you have explicit events that create specific state changes. Your app is a succession of these events that certainly help when debugging and thinking about the potential states your app can be in.

Like other state management solutions, it also 'writes' all your shouldComponentUpdate methods for you.
It depends on the context and strictness of the term.

Much of it is the reverse: "credit score" means "FICO score" when you are being assessed, but not when you request a "free credit score".
The Cruel Irony of the DACA Database
A google search for "https://encrypted.google.com/search?hl=en&q=programming%20la... might be a first step

https://insights.stackoverflow.com/survey/2017#technology
He was fired for insinuating women are genetically inferior to men.

The fact he couched it in pseudo-science, doesn't make that any less true. That's harmful to Google's image, and no woman would want to work with him after that, so he's toxic. They have every right to fire such a person.
To me the fact that the data was hacked represents no real change, as I've viewed the organizations that had access to this information just as adversarial as the crooks who stole it. At least now anybody can pay the price to see, and that means there is no corporate monopoly on the data about us. It's time to face the world of open data and structure ourselves so that it is to our advantage.
The popularity of football among women (I don't know the stats but at games they're a significant portion of the audience) would seem to disprove this logic. For many people sports are one of the few times the entire family sits down together and roots for a single purpose. I would bet that experiencing this atmosphere as a child is nearly as effective in promoting the sport as playing the game itself.
I don't know about the challenges for a web dev. But as a MacOS user I love Safari. It is very fast, it does not drain my battery and it gives me an increadibly streamlimed experience (bookmarks sync across all my Apple devices, I can continue a session that I started on my iOS device on my Mac).

Chrome kills my battery. Firefox is way to slow (startup time).
> Remember when black peoples were terribly oppressed in the South

Actually I don't remember, I wasn't alive or in the US for that. But from my understanding, calling that "bias" is a bit of an understatement.

> For every person biased against women in some field

What bias and which people? A general anti-women bias in society? In all men? White men? Only in tech? Only men in tech against women in tech? Any specifics at all for your hypothesis?

Fact is, there are fewer women than men doing CS degrees, about 20% AFAIK. That seems broadly to carry over to the ratio of genders in tech roles. Women seem to earn less than men. We don't really know why either is the case, but people are working hard to "correct" that, even though we have no idea what correct looks like. Some people think 50% would be good, because that's roughly the ratio in the general population. Looking at other majors and fields, 50% sometimes happens, sometimes doesn't.

Maybe there are better ways to approach this than to claim everybody is prejudice - maybe that's true, but is it constructive? Why is the ratio in tech disproportionate? Why is the ratio in veterinarians disproportionate? Are these equally important issues? Are they getting the same amount of coverage?

At the moment, it seems that all the nuance we've got is a hammer, and publications like the New York Times are sure reporting on a lot of nails.

Bonus question: Is Big Bang Theory good or bad for the tech industry, and do you think it will increase, decrease, or have no effect on gender ratios in tech?
> By developing on it you are ensuring you don't use features every other browser but

Sure. But isn't developing against the least common denominator precisely what web development has been all about in the past 20 years or so?

Edit: Just to expand on that...

Then, there was a laundry list of web shops that were targeting IE first because "more advanced" and complaining about other browsers because they "suck". And it looked wrong to just about everyone else who targeted other browsers because Microsoft.

Now, we've a laundry list of web shops that are targeting Chrome first because "more advanced" and complaining about other browsers because they "suck". And for some reason those browsers should all catch-up and fast because Google?
To make a counterexample, my grandmother had a Zil refrigerator she bought in the 1950's (http://i.imgur.com/POw7U6R.jpg) that worked for over 50 years until the late 2000's. It would have probably worked another 50, if we hadn't changed it for a modern larger and more energy efficient one.
I think this can apply widely across the animal kingdom. Only a certain amount of workers can be effective once a level of productivity is achieved. Operating at full capacity might not be possible or evolutionary effective in this environment. Different colonies with more environmental pressures probably have higher engagement/productivity.
Isn't this like "hacking" the justice system, and shouldn't it be punished accordingly?
> Same goes for kernel, libc, all other libraries, and pretty much anything else. This is not an argument for not upgrading them though.

If you have a budget to responsibly keep all that stuff up to date in your project and test to make sure you haven't broken anything, more power to you. It's a total waste most of the time, but why not? Especially if you're a consultant and getting paid by the hour

Firmware is different. It's not always possible to back out a change and you risk bricking hardware every time you apply an update, especially in the realm of PC-based servers. If something like a NIC or motherboard is performing as expected, updating the firmware for no reason is generally a stupid thing to do.

Edit: oh, you're the author. Please stop telling people to do this, or at least explain the risk. At a minimum, if the vendor provides a defect list with each update, it's not necessary to blindly apply updates. Take the changes if they're needed. It's possible you're accustomed to working on high-grade hardware that exhibits fewer of these firmware related blowups, but that doesn't mean it does not happen to people...
bottom line is: if your language allows you to compare apples to oranges, then you are comparing apple to oranges.
Building Backup Server for Photography
Robots Still Haven’t Taken Over: A brief history of machine anxiety
According to the nextflix prize leaderborad at http://www.netflixprize.com/leaderboard.html, this result wouldn't even be in the top 1000. More than that, due to the absence of compositional structure in the data I wouldn't expect this approach to work well. Would love to hear more insights, I'm digging into the paper now.

All that said, open code for running this on arbitrary data is great to have! A thanks to Oleksii Kuchaiev.
If they aren't qualified to design with least privilege, what are they qualified for, beyond maybe cat videos?
More of my former colleagues work on the Stripe security team than at any other firm (besides NCC, our acquirer). They do a great job. But Stripe is a tiny company with very few products and a unified development culture with a management team organized around bringing technology products to market.

And they aren't perfect. They will eventually screw something up.

Comparing Stripe to Equifax is unreasonable. Equifax has about 10,000 employees. Stripe has less than 1,000.

And, once again, please don't try to win an argument by putting me in the position of defending Equifax. That's not what I'm doing. My point is that practically every company of Equifax's size has similar problems.
Telling people to "not fall for it" sounds like talking about what people will currently be offered. Given the level of misunderstanding about pensions generally I think just telling people this is dangerous.
Last time I tried pipenv (a month ago?) there was a breaking unresolved bug on Ubuntu 16.04.

I'm not easy to hold grudges, but such a critical low-level tool manages to break for what I see as one of the most likely server environments to run on... I hold off on converting the (annoying, but working) virtualenv(wrapper) stuff. Just not worth it, now that I spent weeks of my life handling the annoyance that is python packaging and deployment.
Using "strict" vs. "non-strict" and "static" vs. "dynamic" will increase a lot the odds of people understanding.
Shouldn't we hold credit reporting agencies to a higher standard than the rest of the Fortune 100 though? After all, they store sensitive personal information about the vast majority of US adults.
Oh really? Please explain. I have sold a house before, and I got back more than I paid, after taxes and agent fees, after maintenance and repairs.

*keep in mind that "most" means better than 50%. Are you claiming that the average house sold in the US gets a worse than 50% return?
In 1985, it was the ARPAnet (research) and MILnet (military/government). It was funded by the US Government, and was not the open "Internet" we enjoy today, which consists of thousands of privately-owned interconnected networks.

Pournelle was a GUEST USER of a system at MIT, accessing it through an ARPAnet dialup node (of which he did not have official permission to use).

The admins of said system requested that he not talk about non-official use of the ARPAnet in his BYTE column (so that the government people funding the network, not ask "why does this scifi writer have access to these systems?").

He persisted, and then he decided to be rude and mouth off to the people that ran the system he was a guest user of. When they got tired of it and locked his account, he threatened to use his contacts / influence to make things difficult for them, and falsely claimed it was due to politics and not his own entitled attitude.

How is that not being a huge jerk? Honestly, that's well into a-hole territory in my opinion.
I worked using VA-Smalltalk and Envy for 3 years.
One interesting thing about Envy, is that all the versioning model was available as objects that you can manipulate, and versioning was not file based but per module/class/method.

In our team each developer worked on a branch, we developed an in-house tool to automatically merge all the branches. Having the class model available made easy to identify conflicts and class shape changes. The tool resolved most of the cases and also created the migration script for the object database (GemStone).

Nowadays I'm working with JavaScript, using VSCode, webpack, and a long list of tools... it feels like something went wrong in the dev tooling evolution.
Chinese government is working on a timetable to end sales of fossil-fuel cars
Do you have an example of a case where a semaphore helps with high contention?

I would think that using a lock free atomic solution would win there, assuming the contention is high and consistent. Even if the semaphore is marginally faster than a mutex for the uncontended case, both will call into kernel for the contended case. That's 25 ns for uncontended and 150 us for contended. Ie. you could spin about 6000 times on the atomic operation and still win.

I agree with you that discipline and applying best practices without compromise is the way to solve multithreaded problems. Testing, verification and tooling need to be top notch or the result is something that works most of the time.
Oy vey.

What is the problem that you solve that would justify adding a dependency on an external service that shims itself between us and our precious users?

Rolling out features to subsets of users in a controlled fashion... it's just a such damn trivial thing to do.
What is the discovery process for these things like? What I mean is: if I buy 100 of them, put them in a room and turn them on, how do they work together to organize IP addresses?

Humans normally do this by "hi, I'm John" and "hi John, I'm Bob."

Do these things broadcast a MAC address set at the factory?

I ask because I think that when mesh networks become really interesting me is when they are entirely decentralised, as in finding a way for these things to have a universally unique MAC the second they turn on for the first time without some sort of authoritative server.
That's a cool idea. Any ideas how you'd want to distinguish between cohorts?
Come on! Tongue in cheek

a += !!record.bool;

There now. Happier?
Calling all hackers, brute force much?
Ask HN: Who's your best marketing hire?
Hired someone for marketing your startup? What did he/she contribute and what was your ROI like?
Write letters. Explain your situation. Make not fixing your problem a bigger problem than fixing your problem. Do so credibly.

That's the meta-message of TFA.
Agreed. At this point, the only sensible thing to do is to assume that Equifax is -- and perhaps has been -- compromised indefinitely. If not by external agents, then by internal incompetence or malfeasance. They've not clearly demonstrated either the intention or the ability to handle this breach in a diligent, professional, ethically sound way. To me, that calls into serious question their ability to embody those qualities in their operations before the breach as well.
> I'm trying to compare two completely arbitrary variables

But WHY are you trying to compare them? The fact that one of these variables is a field called LENGTH is highly suggestive of some particular semantics that you intend these variables to have.

> there's a dozen different ways where that comparison could involve type coercion

That's right, which is the reason I can't answer your question as you posed it.

I predict that if you try to fill in the details what you will find is that you will be unable to do so in any way that does not reveal the presence of something badly wrong in your design.

> The "third boolean" value is useless unless you completely redesign the language.

You have to add an OTHERWISE clause to the IF statement and change the semantics of some operators. That's not a "complete redesign."
I remain unconvinced that just because it's difficult for a couple of JavaScript implementations, that we're still not talking about an implementation problem.

How exactly does anyone think that v8 doing something badly, is proof that something cannot be done well?
I wonder if this law still makes sense. I feel it could be altered to say that recording someone without them even knowing you are listening should be illegal, but I don't see why it should be illegal to record a consenting conversation between two people.

Btw, does it apply to video recording as well?
* sigh... *

Millennials killed football.
Why 10 years? I mean, I don't see how one could defend any term shorter than the term of the validity and danger of the information stolen. I won't get a new SSN in 10 years. I won't get a new name. All the information will persist and still be useful. I'm personally in a worse position as my information was part of the OPM breach years ago and even images of my fingerprints are in the wild. And I got 18 months of free credit monitoring out of it.

When a charge of more than $100 is made on my credit card, I get a text message instantly. When I log into my banks web system, I get a text message instantly. I was able to set those things up. I don't see why it would be unreasonable to have a similar thing set up so that I could be alerted every single time my credit history is queried with information about who is querying it for what purpose, ideally with the ability to block it by replying to the text message.
What does her competence in music theory say about her knowledge of IT security? Intelligent humans beings usually aren’t limited to a single area of interest.
I am curious what programmer would make such a choice vs. calling random or asking the user.

However, while undeniably stupid, hopefully they have rate limiting in place so guessing the PIN would not be feasible even if you know the day the credit freeze was put into place.
Please tell me why, i don't get it
The NFL's decline is completely on them.
And require tenants to pay for their own insurance so that the landlord doesn't have to pay if anything happens to stuff the tenants own or if they cause large amounts of property damage.
Scripting, e.g an Alexa skill/IFTT thing/MacOS automation thing.

Or just for one-offs for people who live in the terminal. Not sure I could be bothered to 'insert' from the terminal but 'gcal list tomorrow' seems pretty handy.
I don't see the implied dichotomy here. The separate goals of 'zapping incoming missiles' and provoking the Soviet Union into a destructively expensive arms race are not incompatible.
Does everyone have an equifax username?
Then user could just disable Javascript.
Ben Johnson, creator of BoltDB, thread on OSS burnout and businesses
When I was moving into my first apartment in 2000, one of my planned roommates had the same problem. He had never had any sort of credit/debt account and the landlord wasn't able to actually pull a credit report.
Do you really think a company that has visibly demonstrated this much incompetence thus far would be making smart decisions where you can't see them?
Interest is a good point. But taxes are in the noise where I live, as is all the rest of your list.

Either way, we could debate a whole bunch of minor costs, and it's obviously not the same for everyone. But that would be missing the point completely.

If you sell your 500k house for a very very bad return of 125k, you will be 125k ahead of where a renter is. Renting returns nothing. Whether or not I get back 100% of what I put in, the point is when you rent you get nothing back.
Whoa... one guy said on Twitter this was the case in 2007!!
Each device does have a unique MAC address. But the protocols are designed to work even if that MAC address happens to not be unique. The IPv6 address assignment procedure first attempts to claim an IPv6-address based on its MAC address, but before finally assigning the address, the device will test if the address is already taken. If another device in the same network happens to have the same MAC address, that device will have claimed the same IPv6 address already and that device will defend its address. The new device will then choose a new IPv6 address to avoid collisions.
As an anecdote, the only sport made for gambling is horse racing.
Unfortunately a mostly true statement in my experience...

And papers the provide code often do not provide enough or the correct code to replicate the paper. Looking at you, XNOR-Net
Even if it works, a patent is to defend your exploitation of the product on that market. If company A defends against company B patent claims, and continue to produce the drug, what prevents company B, C, D and E from going to other tribes, moving their disputed-but-dismissed-case patents there, and start producing the drug too?

At this point, shouldn't we just ignore patents?
Yes, check your states laws. Some states are two-party consent, but a good number are one-party consent states. And in a one-party consent state you recording yourself is legal without the other parties knowledge because you gave your consent to make the recording of yourself.
At the very least, you could separate identity and data access and treat each person's data as a separate tenant.

The main data store that contains everyone's credit reports (high side), should have physical and network isolation from the public site (low side). Only copy from high side to low side when someone becomes a customer.

(disclaimer: IANA security expert, but the perfect is the enemy of the good)
Secret Government of Canada data stored on U.S. servers? Memo raises possibility
The problem I have with most graph plotting libraries: the examples always look great, but they tend to break down on real world data in unexpected ways. Think of overlapping labels, inappropriately placed legends, inappropriately chosen axis ranges, et cetera.
Also: I played football for 10 years and dislike watching all sports.

Well, except women's volleyball of course.
Racist. He’s racist. And probably a nationalist. Tends to go hand in hand.
The advice here is very American-centric and cites US law. You should look up the laws in the UK. Letter writing may not have the same punch that it does in the US.