skysight-inc/HackerNews huggingface dataset:
I've had a prodigal son moment with Postgres myself. I found that even for many tasks that seem to favour NoSQL (time series, etc.) you get lot more bang for the buck in terms of performance for the same resource usage with Postgres.
It's been said before, but it bears repeating that this behavior by NK is rational in its own way. Seeing what has happened to other small tyrannical nations who gave up their nuclear ambitions, NK would be crazy to act otherwise. Does anyone know of an example like Saddam Hussein, Kadafi, etc who gave up such ambitions and lived peaceably thereafter? (That's not a rhetorical question.)
Digital Security: 5 Alternatives to Passwords
It is a Google project, not a Google product.
I saw this demonstrated on "Tomorrow's World" in the late 1980s, I think. Did Woody Norris really invent this?
More needs to be done by package managers to warn end users.

One scenario that worries me is where apps age and use popular trusted dependancies (e.g. gems on Github).

When those gems stop being maintained but need to be updated to work (say with latest OSX) - it's common to quickly look at the latest forks available and select the one that now works correctly - but without a detailed inspection of the new code it's potentially kryptonite for a production datacenter.
> High paying computer jobs are not filled with nerds

I beg to differ
What's overpriced to you? Any business where an employee can maybe eek out $13 an hour?
It's not generally true that built-in packages which also appear on PyPI are malicious.

Many batteries-included packages are also maintained outside of CPython. This is because: (1) in many cases they existed outside prior to being included in CPython, (2) they can experiment with new features before they're included in the CPython version of their package.
I knew a person who when looking for work they wanted, also sent out application to other places that they was less interested in but then demanding close to unreasonable pay (around what someone who had worked 10 years would get).

And they did land one of those less interesting jobs, earning similar to those coworkers who had been there for 10 years, and there were nothing illegal in this. Have a bunch of employable credentials, send out enough applications demanding above average pay, and you are going to likely end up with above average pay.
The Shkreli Syndrome: Youthful Trouble, Tech Success, Then a Fall
> I wonder if sound is finally being weaponized or if it's actually microwaves as others have suggested?

Yes, sound has been weaponized.

https://en.wikipedia.org/wiki/Sonic_weapon
That's pretty much the only thing I don't do on facebook. That and play games.
This website is shit on mobile with its fixed top bar taking up 20% of the screen space.
Recognizing Game Genres from Screenshots Using CNNs
YouTube pulled North Korean state TV videos– and researchers are pissed
Tic-Tac-toe Game in C with SDL – Procedural vs. Functional (Part 1)
So let's see.

1. Possibility of Automattic attacking FB with patents = 0%. (No issues here with React)

2. Possibility of FB attacking Automattic with patents (No issues here; Patent grant doesn't get revoked for countersuing).

3. Wordpress end users getting attacked by FaceBook (Again no issues here, grant doesn't get revoked for countersuing).

4. Wordpress end users planning to use software patents against FB - The guys who actually have a problem.

So basically, the FUD helped individuals/trolls/companies who want to wield software patents as a weapon; to the detriment of the wider community which sees software patents as evil.
I suspect to build a steady base of pool rides. Once the market stabilizes they can dump the promo and keep the pool drivers busy.
Some "road noise" is caused by tires making contact with the road surface. This might not apply in stop-and-go traffic, but certainly has an effect on highways which pass through many cities. Also, honking.
Looked at the issue, Too many Vue fans are there, if I was a core contributor, I would be tempted to lock the discussion to contributors only.
Augmented Analytics: The Next Step in Data and Analytics
I already have [1]. Are you mistaken or referring to something else?

[1] https://www.dni.gov/files/documents/ICA_2017_01.pdf
I think to complete the picture, we need to consider "what percentage of ex-google engineers leave.. and fail". The difference might make up the pay gap.
It's not as certain as the moon landings.

I agree Russia is almost certainly responsible. There is a ton of publicly available circumstantial evidence that points to them.

But without libpcap dumps showing what really went down, we can only take the word of various conflicted people.

It's totally possible the NSA had the hackers bugged, and even saw the order come in from their Russian handler, but we haven't seen anything like this ourselves.
IIRC a further complication in German is that the dots in ä/ö/ü started out as a small "e" on top of the letter, whereas the dots in most other Latin-based languages (e.g. in English ë) are mere accents. This is why the "expanded" versions of umlauts are still ae/oe/ue.

The alphabet I learned as a German child in the 1990s certainly didn't include the umlauts or eszett, nor did it acknowledge them as distinct letters. The alphabet had 26 letters, the umlauts were counted separately and the eszett was always the odd one out (often considered simply a special orthographic variant of the double-s).

So to that extent, the umlauts and eszett are definitely less "letter-like" than the Nordic å or ø which are proudly included in those countries' alphabets.
It's also very possible that a far more malicious attack has happened, but not been discovered.
The clang llvm frontend is for C, C++ and Objective-C.
My favorite bit is the built-in file manager with drag and drop.

Also, multi-term mode can be quite handy at times (if scary)
A review system unfortunately isn't likely to be practicable with current development models. npm alone has over 500,000 packages (http://www.modulecounts.com/) so even a one time review isn't going to happen.

If people want a more trusted solution the likely outcome is that they'll need to use a smaller more static set of libraries and then either do the audits themselves, or outsource that to a 3rd party.

Ofc with current speeds of change and deployments, it doesn't seem likely that many companies will adopt that model.
Can this be used with load balancers on GCE?
Hey HN, I gathered some fresh JavaScript articles for you
Interesting quote: "we decided to compute all statistics on demand. This was something we previously tried in RethinkDB, but the results were not good... When we tried implementing statistics as SQL queries in Postgres, we were amazed by the performance. We could implement complex statistics involving data from many tables."

I think standard line "use right tool for the job" is still the ultimate answer. Data in most applications is relational, and you need to query it in different ways that weren't anticipated at the beginning, hence the longevity of SQL.

That said, I too often see HN commentators say something like "this data was only 100 GB? Why didn't they just put it in Postgres?" which is not as clever as the writer may think. Try doing text search on a few million SQL rows, or generating product recommendations, or finding trending topics... Elasticsearch and other 'big data' tools will do it much quicker than SQL because its a different category of problem. It's not about the data size, it's about the type of processing required. (Edited my last line here a bit based on replies below.)
I'm always fascinated by the amount of trust being exhibited by the developers of some node projects I've seen. Their projects have an order of magnitude more dependencies than I'm used to - and at the other end of each one is someone publishing some small module to npm with an unknown amount of review. I feel safe(r) installing dependencies from apt because I know the processes the Debian community follows before packages are included in the official repos.
From what I've gathered a tinfoil hat would have the reverse effect, acting as a parabolic antenna directing radio waves into the persons head.
No, no you wouldn't because there's a legal precedent saying that any data stored outside your home is fair game. It's ridiculous the dystopia we are building, quite frankly. It's a technological tyranny.
in Polish you have both ó and u, which are pronounced exactly the same, but words using them are inflected differently
No, you'll only lose the patent license for React, leaving you with exactly the same copyright license you would have had with plain BSD. There is no scenario in which the PATENTS file (not clause) enables Facebook to infringe on others' patents any more than they would have been able to do with plain BSD. If you think this makes using React risky, then you'd also have to believe that using thousands of other BSD-licensed projects has been risky for years. That is, if you want to be logically or legally consistent.

This "adds risk" argument is very familiar from other FUD campaigns (e.g. Microsoft's) against open source in general. It's pretty weird to see people who claim to believe in open source pushing arguments that work against most open source.
Yeah I was thinking more about concealing the fact there was a signal at all. More like stegano, then.
Moreover, that could be in an environment of intense EM jamming: ultrasonic signals would pass but not EM signals.
Fat Man and Little Boy: how the stigma of nuclear war was unravelled
Is there a good description somewhere of how to use new methods like Object.freeze, Object.defineProperty etc?
Because all investigations from the three letter agencies agree on it.

We don't need to trust US agencies who claim "it was them but we can't tell you why"

There's a lot of evidence which came out before and during the attacks from non-government sources which points to the culprits.

I've posted this before, but I think it's important people understand what public evidence is available:

The 2014 report into ATP-28: https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... presenting pretty compelling (if circumstantial) evidence that group is Russian state backed.

(July) 2016 report into the DNC hacking, showing it was first breached by ATP-29 (The other Russian state backed hacking group), but the leaks almost certainly came from a second breach by ATP-28 later: https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

Note the dates here. 2014 is way before anyone could claim some kind of anti-Trump deep state conspiracy. There's the Olympic hacks (which clearly benefited Russian interests) by the same group too.

Ironically, even Putin's comments on the matter are more credible: "Hackers are free people, just like artists who wake up in the morning in a good mood and start painting," he said. "The hackers are the same. They would wake up, read about something going on in interstate relations and if they feel patriotic, they may try to contribute to the fight against those who speak badly about Russia."[1]

That GP is being downvoted for stating this is disconcerting.

Thanks, but I'm not surprised. Feel free to correct it ;)

[1] http://www.zdnet.com/article/putin-says-russia-doesnt-hack-o...
Should consumers be responsible for protecting their credit history?
Package managers are providing (in the most case) a free service, so it's hard to see a strong case for them providing more services here.

The problem is one of scale. npm has over 500,000 packages, so no manual review will address their scale over the whole repository.

Until the developer market shows that they'll pay for a more secure service (e.g. package signed, reviews done etc) I doubt much will change.
The alternative of all the data siloed to a single world power, the US, is not better.

I was going to add ".. unless you're American", but I'm not even sure if such a concentration of power would be a net neutral (or good) in the long run, for any citizen, US or elsewhere.
I had a similar project idea for ages. Instead of LLVM it would static recompile into C macros or C++ inline function calls for each opcode. Then it would compile the output and run the game.

Emulation is just plain fun.
If I don`t have a cancer, Do I deserve donation?
How to Build World Class User Onboarding
> But this is not what happened. The plaintiffs were awarded different pay grades for measurably comparable ability.

The article doesn't say that. It says they were awarded different pay grades given an equal time spent in the worforce, not that their abilities were comparable.
The initial board perspective is similar, but otherwise, the two apps are quite different (One obvious difference is that NeXTStep Chess.app used a bitmapped board with a fixed perspective).

For comparison, the source of the older Chess is also available, in https://opensource.apple.com/release/mac-os-x-1015.html though some parts might no longer compile.
We need fully encrypted telephony at all times, too. We need to be secure in our [digital] papers and effects and have the same legal protections as though it were a physical item residing in a safe, preferably better than that.
I don't know, nor did I claim to know? Though in the end it will have to boil down to "because no dictatorship", just probably packaged in a way people understand what that means. Potentially we'll have to live through it before people do understand, though, just as we have with monarchies and dictatorships.
I wonder what would happen if the return payload had some data that would trigger the GFoC
Yes it is worrisome because of how the cloud operates.
The term "FUD" is typically used to denote "unreasonable" or "unfounded" fear/uncertainty/doubt. I'm not sure that it applies to situations where doubt is NOT unreasonable.
I think you've hit the nail on the head here. I don't think it's a surprise to anyone that Lyft needs money. Both Lyft and Uber are operating at a big loss, and Lyft has been bleeding drivers over to Uber for the last couple of months if the user surveys from /r/lyft and /r/uber on reddit are any thing to go by.

If someone in Lyft management thinks that this leak will help twist Alphabet's arm even a little, of course they are going to leak it.
And what would you recommend instead?
Another fun fact to consider is that with many package formats, you can execute arbitrary code at install time so if a malicious package can get into a repository, it's very likely to start compromising systems quickly.

Whilst a package manager repo. compromise would be the biggest bang in terms of attack, compromising the credentials of the developers of popualar libraries would be an easier attack (and indeed is already happening https://twitter.com/chrispederick/status/892768218162487300)
It's certainly not widely accepted. Almost only libertarians have such a dogmatic understanding of the meaning of voluntary - simply because it defies common sense. Furthermore I have no idea where I defined it as including "putting a gun to somebody's head". However I do recognize, unlike libertarians, that there's both direct and indirect ways of putting a gun towards someones head. Only acknowledging the former is to, as you nicely put it; "redefining language in service of your ideology".

You do realize that even if the common people would have property rights during the age of kings it wouldn't matter? Neither will it in a modern version of it. The concentration of capital/property, and thus kings, would be inevitable. I'm sure this is a feature and not a bug given the demographics of libertarians.

Also you could've spared me the inevitable "Let's compare the idea I oppose by a measurement than I'm not willing to judge my own idea". I'm sure we could compile an equal body count of regimes calling themselves free market/market economy/capitalist or similar. But people using this body count rhetoric seldom accept such comparisons.
> What irks me is you dismissing the argument with your little straw-man and moving on to "the only alternative". You completely disregarded the points of everyone opposite the aisle of you in the most condescending way.

"little" straw man is also condescending.

Plus, a straw man is "an intentionally misrepresented proposition" - not only can we not conclude what OPs intention was, but also it's not clear to me that it is a misrepresentation of the original comment.
There are two camps - those who believe that an open source license implicitly provides patent grants and those who believe an open source license does not allow patent use.

Until such a thing is tested in court (in each country) both ideas have merit.

The patent grant is also worded a bit unclearly - implying that if you sue facebook you will lose the copyright, not only the patent right, to use React.

Even though the lawyers clarified it in FAQ and other places, the wording is still what it is.
And I responded with this (curious for informed feedback):

I just read it. I can't believe this patent was granted. If I'm reading it correctly, it's a patent for an old trick used by every OS and video game ever made. Basically, don't redraw things that aren't in view, and only redraw the bits of things that are in view.

Anyway, I can't see how this is applicable to React, as it really isn't how the v-dom works at all. The v-dom isn't about failing to draw clipped items. The v-dom is about diffing two trees and only updating changed items.

Am I totally off base here?
It was Inside The KKK.

http://www.imdb.com/title/tt4848130/

I don't think I've seen anything quite so darkly comic as their fire safety class before their cross burning ceremony, as their artificial-fiber robes are highly flammable.
Interesting. I misremembered the Jenkins traffic light originally using green (I probably got confused by a plugin which changes the color) and was convinced it was a weird accessibility change.

For the record: I'm green-blind and I always found the Jenkins colors confusing because red is too pale and light to provide good contrast with the blue. Hence I always assumed it was just a poorly executed accessibility fix.
This is really cool!

Is there a way to link/trace the cards across columns?

I've been wanting to build an app for a long time that would help fiction writers, somehow encourage creativity but also provide structure without getting to complex or inhibitive. Also port gitflow principles into literary undertakings (man it'd be so cool to submit merge requests to existing works and fork fork stories, run commit diffs to the evolution of a work). Allow you to tag sections so you can isolate things like a character's dialogue or descriptions to review consistency and/or desired evolution.

It's one of those things that has become so built up in my head I'm pretty sure it's not feasible anymore.

Anyway, seeing projects like this makes me happy :) Thanks for sharing.
Batteries don't need rare earth metals and neither do newer electric motors.
I guarantee they will write a book after all of this.

Their story, their raw emotion, the disparity, diversity and oh my the adversity; all beautifully painted on a backdrop of capitalization and autism.

Wake me up when it's time. I'll be here, crying.
We do exactly what you describe on about 80TB dataset stored across a number of PG instances. The 100GB comments are extremely clever because running a query against a dataset that fully fits in RAM will be blazingly fast. "Try doing text search on a few million SQL rows" we are doing it on billions of rows.
See https://get.slack.help/hc/en-us/articles/205240127-mention-a... for a description of the UI for atting a duplicate display name.
Early Facebook employee sets up special purpose acquisition company (SPAC)
Seems like this would be fantastic if we could get more news aggregator sites onboard...
Most welcome! And, yeah, it was kind of a desperation move on my part, but I've found Sierra and the 2016 15" Touch Bar model to be a major regression in that regard. Took most of a week to get external displays to work sort of reliably, and even still I get a hard lock and have to power-cycle if I incautiously plug in the displays before waking the machine.
If the video games of my childhood are to be believed, Japanese also does this for purple and black.
See my response to nothingnonidin.

https://news.ycombinator.com/item?id=15244420
I love the name, the salmon jumps upstream.
Harvard withdraws invitation to Chelsea Manning to be a visiting fellow
Postgres is always the answer.
I think a more Linux-like approach to package repos is better - a curated package repository run by volunteers in maintainership roles. Then you have a human being verifying the upstream and keeping malware out, and get more consistency across packages as a bonus. If you want your package added it's as simple as sending an email and provides a new avenue for people to contribute to the success of the ecosystem as package maintainers.

When you make the next big thing, consider this approach.
8 Reasons Why People Unsubscribe and How to Keep Them
No! It's an Abomination^TM

Keep stuff out of the middle of my zeros, please.

The circle surrounding nothing wonderfully symbolizes a subtle concept.

Drop a dot in hole and now what are you symbolizing? A nice golf shot? When you put a slash across it are you warning me away?

No, no. I prefer my voids empty, thanks very much.
>  Rethink is no longer commercially maintained.

Just wondering, seeing as am not a Postgress user - is Postgress commercially maintained? Or is it pure open source (like I believe RethinkDB is currently)?
https://news.ycombinator.com/item?id=15255018
This isn't, in any way, a new problem. I did a presentation on this topic for OWASP AppSecEU 2015 (https://www.youtube.com/watch?v=Wn190b4EJWk&list=PLpr-xdpM8w...) and when doing the research for that I encountered cases of repo. attacks and compromise.

IME the problem will continue unless the customers (e.g. companies making use of the libraries hosted) are willing to pay more for a service with higher levels of assurance.

The budget required to implement additional security at scale is quite high, and probably not a good match with a free (at point of use) service.
Nice to see more alternatives to PuTTY. PuTTY's lack of a decent website hosting has been the source of too much confusion including accidental downloading of malicious versions.
Been using this a few months and love it. The macro functions are really useful and tabs will change your life.
Maybe most of those 500,000 packages simply shouldn't be trusted.

There's a precedent for curated subsets of package ecosystems. Stackage for Haskell is an example, although it doesn't have security as the primary goal.

I don't think we should focus on actual audits of packages. Just checking that packages seem basically credible seems like a better approach because it's doable.
Cassini's Saturn Mission Goes Out in a Blaze of Glory
As I understand it, it isn't that people don't "see" the colors if they aren't defined but that they haven't learned to distinguish between them. A similar example might be cars. I have a 2009 Honda Fit (Jazz in some parts of the world). To most people, a Fit is a Fit but because I have one, I can tell the difference between the first second and third generation just by glancing at them. If I point out the differences, someone will see them but they don't seem them instantly like I do.
Has anybody else tried using native Win32 OpenSSH like myself instead of PuTTy?

https://github.com/PowerShell/Win32-OpenSSH

Edit: Also, the linked site for MTPuTTy doesn't seem to want to load for me.
Any method of software distribution which is not rooted in cryptographic author verification against a fine-grained, user-manageable trust store should be put bellow the sanity waterline, 20 years ago.
I met Jeffrey at a conference here in Dallas last year. Incredibly humble guy and full of great stories. I'm happy for his success!
Five hundred thousand packages, am I reading it right? I dont believe top ten OS package managers combined would reach that number. Either this is a typo or it's crazy.
Automate or Die Without Breaking Your Internet