skysight-inc/HackerNews huggingface dataset:
Well, not really. That's the germ of the story, which goes on to talk about how various US government agencies are funding various encrypted discussion apps and calling into question the idea that we should trust them, to talk about how the OS the phone runs on itself is likely unsafe from government eyes (allowing an endrun around the apps anyway), and, in general, how encrypted chat apps are a poor substitute for actually reining in government surveillance.
We won't really know until Equifax releases the full RCA (root cause analysis).

The attack could be way more sophisticated and involve several hacks through the stack.

Injecting a JSON blob to the Struts REST deserializer that effectively results in executing payload code would indicate high investment in the attack.

The hacker(s) possibly had insider information. They possibly used social hacking techniques to acquire data decryption keys.

Given Equifax stores more than 143M records, the initial report would imply some sort of data segmentation limited the scope of damage. If the doors were wide open, why didn't the hackers take 100% of the records?

None of this excuses Equifax or removes liability (I've personally initiated a credit freeze and will likely need a LifeLock Plus account for the rest of my life thanks to this breach).
This is what build systems do. What additional complexity are you referring to? Is there a particular project that you are thinking of?
This is silly, because losing data would be lower outrage, and they might even purchase the data from other agencies so we wouldn't even know it happen.

Also the data that leaked is not the valuable data to them. See how proudly they stated that no core databases were affected? Not giving a damn about us?

What's valuable to them and to banks that use them are the actual information about our credit. If that was compromised that would kill them, because they would lose trust of their real customers (banks).
From the New York Times [0]:
In the meantime, here’s hoping that this breach is the nudge you need to finally sign up for permanent freezes on your credit files. I’ve used them for years, and here’s how they work. You sign up (and pay some fees, because you knew it wasn’t going to be free to protect data that you didn’t ask these companies to store, right?) at Equifax’s, Experian’s and TransUnion’s websites. Christina Bater, managing director at Barrett Asset Management in New York, suggests freezing your file at the little-known company Innovis, too. Hey, why not?

[0] https://www.nytimes.com/2017/09/08/your-money/identity-theft...
https://www.washingtonpost.com/business/economy/five-facts-a...

There are quite a few, actually.
Like in any Ponzi scheme - FIFO with profit. Anyway whatever you want to sell you need to find enough buyers who will pay what you want. Simply supply and demand works here [0]. See more topics on microeconomics to get better understanding how markets work.

[0] https://en.m.wikipedia.org/wiki/Supply_and_demand
Indeed it does, and it's horribly error-prone because people don't actually understand it :/. It can also lead to quite convoluted query logic because you're giving up the "law of the excluded middle"[1] (amongst other things).

For my money, the only sane thing to do with e.g. "null >= 0" is to throw an exception. (Even better would be just rejecting it at compile time, but JS obviously doesn't have that luxury.)

[1] https://en.wikipedia.org/wiki/Null_(SQL)#Law_of_the_excluded...

EDIT: Ninja edit: I do understand that NaN has 'reasons', but ideally it'd really want NaN == x to trap rather than just doing 'the weird thing'.
They say their approach relies on a minimal amount of rules, however the most prominent method in their ensemble is a rule based bot.
Why should you dismiss Firefox based on UI similarities ? :/
And, by the way, it's not Firefox being like Chromium in terms of UI…

I've been a long time Firefox user until the early days of Google Chrome and I remember doing the switch just for the amazing startup time of the latter and then being acquaintanced to it.
Nowadays I use the Opera (beta) flavor of Chromium due to the team effort in providing a slightly (but appreciable) better experience.

Firefox seems to be in period of internal renaissance which I greatly appreciate; something that remind me of the hype around it during it's 3rd major release.

I tried the Nightly release last week and, being on a laptop, the only thing that currently hold me back is it's lack of a battery-friendly mode – like the one I use daily with Opera – and other little details.
Influencer Marketing is already dull, boring and repetitive. What gives?
Most of us will employ some or the other kind of influencer(s) to sell our product - be a tech junkie blogger or a therapist promoting an app like Headspace. It's beyond just fashion and beauty gurus.
Would love to hear your thoughts about what has made this industry already so boring and repetitive? On most platforms, influencers are sold like fresh fish of the menu with the same old formula (find influencer, create campaign, execute campaign, pay). How do you think we can fix it?
We think it needs more strategic excitement and formula shifting (especially since the marketing investment by brands is just shooting up).
Your thoughts??
And, even if you know what you are doing, this is intrinsically a hard problem, you need to know exactly what information should be accessible to each server
My rule-of-thumb for assessing security mindset is STS header. Which they don't have. That tiny Norton secured icon does not make me extra confident.
I'm trying to compare two completely arbitrary variables: the point is there's a dozen different ways where that comparison could involve type coercion. The "third boolean" value is useless unless you completely redesign the language.
“I’ve Fallen in Love with the Lenovo ThinkPad X1 Yoga”
What's your point? I'm saying, sitewide pentests almost always succeed.
Well, thank you for the warning. I was certainly trying to tread carefully, as at least in Australia, patriotism or nationalism is becoming synonymous with racism and bigotry, two things I am absolutely not advocating, and my comment had nothing to do with.

I can definitely see what you are saying in your third paragraph, however I would love nothing more than the opposite to happen. One of the things I love about Australia is it's almost complete lack of a single national cuisine, it's a broad spectrum of dozens of different cuisines, often mixed together. A neighbourhood community equivalent of that would be a beautiful thing in my opinion.

I also wasn't suggesting that Europe has one homogeneous identity, I was thinking in my head more about strong identities tied to the individual countries and their histories rather than Europe as a whole. The buildings alone can date back centuries which, I know when I am in the presence of buildings that old, I feel a strong connection to the past.

In regards to a local community, what I was referring to is division on an individual level, where technology is driving individualism so strongly that people don't feel the need to focus on their communities or social groups. Where there may have been regulars at coffee shops who would strike up conversations with eachother and form a small community, perhaps one of many interconnected communities. What I see happening is individuals sitting at coffee shops alone on their phones, not engaging with anyone.

I've been trying to re-engage with the community which is why this was an interesting talking point for me, but I've noticed that while it's great that I am not face first into my phone, it hasn't helped that much as everyone else still is. Trying to get groups of friends together normally results in half of them bailing because it's easy to do. I noticed when I ditched my phone entirely for a few weeks, I was much better at going places to see people, because I said I would and had no easy out.
There is no JVM without Java, your precious Kotlin code needs Java to run on the JVM, and to make use of all those nice libraries written in Java.

Even more so when Hotspot finally gets replaced by Graal, as long term plan on the Java's future roadmap.

Likewise on Android, yes Kotlin now has official support, but AOSP Framework code is still Java and it will stay like that for the years to come.
This again varies between jurisdictions, as far as I'm aware.
If one wanted to go about simulating one of these in a homelab what sort of hardware would your recommend that is price accessible? even if a smaller mesh like 20-30 nodes.
I do think consensus forms a critical part of the process. But consensus does not mean unanimity, and not every objection requires changing the plan to accommodate it.

An RFC should seek to articulate the key constraints, surface every unique point of disagreement, and address every one of those. Sometimes, addressing such a point may involve changing the proposal; other times, it'll involve providing a considered and thoughtful response that amounts to "no, and here's why not". That may lead to someone dropping the objection on further consideration, or refining their concerns in an effort to better articulate what they value that they feel the proposal doesn't deal with. And occasionally, even after that, the answer may remain "no", and the objection will stay on record as disagreement with the consensus.
Can we get a kickstarter for some sort of automailing service with an API that his site can hit?
I would love to spam equifax with thousands of these letters.
Now that Firefox's UI is becoming more and more like Chrome's, why should anyone continue to use Chrome?

I use it mainly because I like Mozilla and dislike Google. You have to put your money where your mouth is.
Productivity hacks to rule kindergarten like a Silicon Valley boss
Thank you. I will keep writing, though I imagine the themes will shift a bit.
There's no evidence so far (that I've seen) that points to Equifax storing SSNs in plaintext. The initial reports so far indicate that the exploit scraped the SSNs while it was in use by other systems, and not at rest in a database. Encryption (whether they do it or not) wouldn't have saved the day here.

> The prevalence and misuse of SSN as an identifier for people is so out of date at this point and weak. We need something different.

I completely agree.
Read TFA.
In the current system paying cash out with a debit card means you are losing money. Most businesses charge the same no matter what method you pay with, but credit cards are usually the only way to get part of that profit.

I've seen a slight increase in debit card rewards, like with Yelp, airline company dining rewards, and BoA rewards, but those are for the most part random and need to be planned spends. My credit cards will always reward me for using them.
I had that thought and almost wrote "outside cheap marketing" or something like that but felt I was taking my negativity to the post too far.
> I sometimes say that the image-based part of Smalltalk is like Lisp, but done right, because the state of the code in your image and the state of the code in your source files can't ever get out of sync; the IDE is the image.

That's what Interlisp did too. Particular Interlisp-D and its later version Medley.
LIVE: 12 Cams from Florida – Irma Hurricane – Waiting for the Hurricane in Miami
Kniterate – Digital Knitting Machines
How do you trace and replay state changes when debugging?
It is not only the US that is like that. Also in Norway it is considered a secret, and you can get a worrying amount of information about someone just by having their social security number.

My guess that this is misguided and muddled security thinking behind this, and is something that happens when the involved institutions do not have a coherent understanding of information security.
Revisiting this comment, it's really not to do with patriotism at all and more about individual existentialism. I seem to have connected to a story arc I didn't realise existed by using the word patriotism.

I feel like having more history lends a bit more material to feel a connection to the past, and like you are part of a continuum, which can lend legitimacy to your current existence. You aren't just a fleshy blob meandering through a brief existence, you are part of a long and storied past of fleshy blobs and your existence is a chance to contribute to that story.
> The point is that implementing a semaphore with a mutex and condition is very easy but more versatile.

Agreed. An interesting exercise is to try the reverse: implementing a condition variable with a semaphore. It's not trivial to do correctly.

I teach OS, and I still cover semaphores, but I always tell the class that I don't think they are very useful. I spend much more time on condition variables.
My two cents about Go
Not The Onion: Equifax's "chief security officer" majored in Music Composition: https://www.linkedin.com/in/susan-m-93069a/. How did she even get this job?
I suspect all the people disagreeing with this either

A) Are not web developers

B) Use macs as their primary development platform

C) Have never had a user using iOS 7 complain that your website is entirely broken and not be able to replicate or debug it because every mac in your office is using OSX 10.10 and Apple have jigged it so you can't run an emulator for iOS <9 and everything on the computer (Except iTunes) refuses to believe the iOS 7 device exists when you finally persuade the customer to bring it in to you.
So this is like the Britney spears recent news?
While I certainly agree in spirit, Equifax is, as has been said elsewhere, unfortunately too big to fail. Too much infrastructure has been built around it.

So, instead of dissolution, I propose two very reasonable remedies that I would consider the absolute minimum in concert with whatever fines and sanctions may be levied:

1. Credit freezes/unfreezes must be offered free in perpetuity. “They cost us money to perform” is not a remotely appropriate objection - offering this for free should be a basic cost of doing business in the credit reporting industry.

2. Affected individuals (everyone, basically) must be granted a minimum of 10 years of credit monitoring following the breach. One year is a free sample you get with a coupon code from a podcast. Furthermore, the service must not auto-renew at the end of the term: send users a security report and let them decide if they want to opt-in to continued monitoring after the term ends.
IANAL, but if you live in a two-party (all-party?) consent state, its only illegal if you don't tell them. You can do exactly what they do: prefix your call with "this call is being recorded for my records".

Remember, your goal isn't to secretly pull out a recording that proves they're lying while in court. You don't want to go to court at all. To that end, you want them to know you're keeping a paper (or virtual paper) trail. So tell them.
If it is that easy, isn't it worthless?
>Soviet tech had to be built for serviceability

also there were significant sharing of tech between military industry and consumer (one can say that in many areas the consumer one was just a minor branch off the main military industry, kind of a USSR version of COTS). TVs and control boards of cruise missiles used the same electronic parts and were built using the same skills/processes - the consumer parts (like transistors, etc) were just the ones that didn't make the higher quality military bin (the military binned parts were marked "VPK" - "Voennaya Priemnaya Komissiya"/"military quality check", and these ones you'd prefer to use in your own electronic projects when/if you could get them).
I live outside US. I had no idea.

Here you get full credit worthiness based on your income, savings and loans.

The income and (by tax proxy) savings are public, so no loans and some income and moderate savings will give you full credit.
How find the popularity of programming languages and libraries? with ranking?
No. That is how you build a credit score. If your goal is to build a credit score, it is not worthless, and it is also not a risk to your personal finances or a means by which it is even possible to get into nontrivial debt.

A large part of the credit score concept is to flag people for whom paying a trivial bill on time is difficult.
I've spent most of my time as a back end developer, occasionally dabbling in some front end code in various MVC frameworks. I always hated it and found it to be tedious.

I recently took up react+redux for a new project and for the first time feel like I'm developing for the UI in a way that makes sense and feel like I'm able to accomplish things way faster than with other clunky frameworks.
10 Random Ideas for September 3, 2017
The obvious logic here is that people need to have played a sport as a child to want to watch it as an adult. I'd be curious to know if there is data to back this up.

Anecdotally, my dad played football growing up, while my three brothers and I played soccer. My dad and 2 of my brothers are extremely dedicated soccer fans now, while I and my other brother love football despite having never played.
Sorry, I have to disagree. Performing regular pen testing is costly, so skiping it is a tradeoff. Employing a team of security engineers is also costly and there aren't enough of them to make that viable for all companies. Tradeoff. But putting such data in direct access of a web server, a single RCE away from exposure? That's not a tradeoff, that's negligence.
Either scientific studies are infallible or politically influenced. If you believe the later, why would you trust those done under other administrations or governments more?
Manages about 20 people.
(OTOH at least it has a vague attempt at developer tools - with Samsung Internet you're on your own matey)
The 25 ns is from "Latency numbers every programmer should know" [0], and the 2017 edition puts it at 17 ns.

That's essentially the cost of an atomic operation in the CPU interconnect.

A futex is a way to implement a mutex so that the uncontended case is just a spinlock acquire, and the contended case falls back to calling the kernel.

[0] https://people.eecs.berkeley.edu/~rcs/research/interactive_l...
You would be intentionally conflating two different definitions of the homograph "may" (i.e. permission "you are allowed to X" versus possibility "X might happen").

You could argue that "any reasonable person" would have interpreted the "may" in that statement as giving you permission to record the call for training purposes (as opposed to letting you know that your call might be recorded for training purposes), but I wouldn't want to be in you shoes when you try.

Just tell them that you're recording the call too, and sidestep the issue entirely.
Honestly, I like implicit coercion of empty stuff into false. Yes, I do agree it makes the code more legible.

That said, objectively it doesn't gain that much. It may be that the cost of having any kind of implicit coercion is bigger than such gain. Implicit numeric coercion is another topic to think about, it is also hard to be sure if it is a net gain.
>I’ve lived in New York and Japan long enough to know that the best food in NYC is average in Japan.

It seems odd to deem the entire culinary culture of an international metropolis as being worth less than the mediocre fare of a country that puts corn and mayonnaise on pizza.

I'm not saying the best food in Japan isn't the best food in the world, but Japan's average is in no way better than the best in NYC. That's just silly.
This sounds suspiciously like the Estonia leak. Specifically like the more extreme Option B part of the leak.

https://edri.org/leaked-document-eu-presidency-calls-for-mas...
Shiny > Old

There's no fix to it, serotonin is a drug and Mark Zuckerberg, Oprah, CNN, FOX, etc are kings.

As Warhol said, everyone will be famous for 15 minutes, it's more about the "15 minutes" attention span than being famous.

Everything can be gamed, Twitter, Facebook (i.e. mood experiments), reddit, instagram, etc. and cheap!

Gotta go check my feed.
Apple’s payments systems haven’t been breached, nor do I recall a breach of Stripe and I would bet my teeth that their security is far better and more proactive than Equifax — a company that’s entire business is based on data brokering. If they can’t handle the “cost” of correct security or, at the very least keeping dependencies updated, then they ought not be in business. If security makes it expensive, then perhaps there should be more competition? The credit bureaus have a near monopoly so they don’t have to be aggressive about security as a Stripe might need to be. That complacency and just general malfeasance means they ought to be sued out of existence. I bet any number of Silicon Valley startups have better security than Equifax — at far lower budgets. It isn’t a cost issue — it’s a competency one.
Bitcoin – Is It Merely ‘A Speculative Bubble’?
TFA says to order a free credit report or put freezes on your accounts, which as I just mentioned require usa addresses.
I think the author is using RFC not to strictly mean, "IEEE Standards Doc" but more, "a description of the problem you're solving and why also open for comments". I guess in my experience shipping code gung-ho is great for about a year maybe two and then you really start getting to a point where every engineer just cakes their own great ideas on without a technical blueprint of what the company is actually building. Maybe that can be addressed by better technical management, but also in my experience technical managers are not great at conveying overall architecture and context (and perhaps it's not really their fault if non exists in the first place--but that's exactly the problem). I agree you're making a trade off but I don't think it has to be as hardcore as a 20 page specification for IPv10. A small startup with a few engineers can share contex and vision just fine.. until they can't. And the big win with RFCs is you put tribal knowledge down on paper up front instead of post facto.

I think the main point I'm trying to make is that RFCs are a way to capture technical intent not just product requirements. It's not enough to just keep adding features whenever product asks for them (which is always and in a volume that's more than than you have time to do). You shouldn't have to get to the point where the thing or the business is going to fall over to get engineers to agree to build responsible software or refactor that shitty thing to actually work properly. I think RFCs help frame building software in an engineering-driven-but-product-inspired-and-business-context-aware way. That's how I want to work, anyway, but what you get with product-driven sprints is product-gets-their-way-and-business-context-is-solved-with-more-funding-for-that-aws-bill-and-for-more-eng-resources-to-build-more-product-value-so-you-can-charge-more-for-the-product.
Well, why wouldn't it make sense?

People were governed and had different levels of say through the history.

Perhaps the most extreme example would be the French Revolution where the aristocracy had more votes per person than the common peasant, and we know whose heads rolled afterwards.

The problem isn't game theory. The problem is that power attracts certain personalities that are not altruistic. The current iteration of having say in common decisions is explicitly trying to curb the maniacs from reaching/staying in power.

> If we can make the world a little bit better, why not?

Sure. But right now, will Trump sing Kumbaya, or is USA regretting the decision? If it was 40-40, imagine him buying 20% of the votes.

"Many forms of Gov­ern­ment have been tried, and will be tried in this world of sin and woe. No one pre­tends that democ­ra­cy is per­fect or all-wise. Indeed it has been said that democ­ra­cy is the worst form of Gov­ern­ment except for all those oth­er forms that have been tried from time to time.…"
- Churchill
Things found on GitHub: shell history