skysight-inc/HackerNews huggingface dataset:
Fingerprints are not passwords, but I don't think it's useful to think of them as usernames either.

This is a much more pragmatic take on it by Troy Hunt, the person behind “Have I been pwned?”: https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pra...

> The first point I'll make here as I begin talking about the 3 main security constructs available is that they're all differently secure.
$200-300k in total compensation.
Correct. However, the 'homo' in homosexual derives from Greek homo, meaning 'same' or something to that effect.
Now there are five links to different sources and only The Guardian article (which I believe was first since it claimed exclusive) is flagged. Right this second the New York Times link is on the front page for me.
That falls under the "too onerous" category I think. I'm not speaking for myself, but for the fact that password managers exist, and yet we still have issues with password security. So that doesn't seem to be a fix for the problem.

We're really fighting human nature here, so maybe the solution is psychological, rather than technological.
I'd argue that what passes for best practice (i.e., symbols, numbers, upper/lower case) is not best practice.

As always, relevant xkcd: https://xkcd.com/936/

For many services, I have a few 'default' words or phrases that I'll use as a base for the password to build up length, followed by a word or two that tie to the specific service; to make up an example, for Twitter it might be "extrawordsthensocialchirpynoise".

Of course then the symbol/number/upper/lower rules become a pain in the arse - unless you build them into the extra words: "3Xtraword$thensocialchirpynoise".

Though all that said, I can't actually remember what my HN password is...
> It was neat.

Are you back on Android now or why do you speak in past tense? If yes, what are the reasons? I'm considering moving to Ubuntu Phone or Sailfish, that's why I'm asking.
> why is the command to download something curl/wget?

I find this easier to remember than Invoke-WebRequest, or is it Invoke-RestMethod?

easier to remember: maybe, but much less discoverable than Invoke-WebRequest/Invoke-RestMethod. this seems to be the overall trend for linux shell commands. a few characters long for easy typing, but otherwise arbitrary strings that you have to remember and have 0 discoverability. GGP's comment was about how you had to search for how to do everything in powershell, so in that respect powershell is at least not worse than bash.
Google asked for this. You reap what you sow.
As I recall, the most interesting feature of these networks is that they do better when learning geometric features in the presence of noise. Without the added geometric structure baked into the network, the real neural nets overfit and 'learn the noise' to a much greater extent.
Except for the TCAM, this chip looks a lot like a GPU.
this is a common argument by those who do not understand biometrics

a biometric is a username and a password

- yes, i know the purpose is to say that the biometric should be used as a password, but that changes the declarative statement quite a bit in my opinion
My opinion is that emacs/spacemacs is more optimized for day to day work, than for the out of box experience. Personally, I'm fine with that, and there are some great editors (like sublime) that work out of the box if you prefer that.

However, the people generally working with/on emacs are not looking for that, they are looking for an editor optimized for customisation. They have already gone through the experience of setting it up, so why would they spend most of their time making it easier out of the box?

There is a cost to everything, and so far most people on emacs side have decided to spend their time on improving it's power, not it's ease of use.
> The problem with longer ranges, even just a few cm, is the prospect for snooping or triggerring unintended authentications.

The advantage of using a watch (or another device with a built-in screen) is that it avoids exactly that problem. When you authenticate, you have to physically press a button on the device, and the screen tells you precisely what it is you're authorizing.

Using capacitive coupling as the initial communication channel would also help with that, since you'd have to actually touch the object you want to authenticate to with your bare skin.
And I say we'll never know what her son may have contributed and she took him from the world.

Odds are, as an African-American son of unmarried teenagers subject to a horrific excuse for public education, he would already have been a victim of the "justice system". Like all of our Wars, our Wars on Drugs and Crime are not designed to be "won" by any of their direct participants. Killing one's own child, whether before or after an arbitrary event, is an act of hopelessness. It's not hard to understand how someone without hope could do regrettable things. Nor is it hard to understand how the status quo's educational mascot, or at least the administrative cretins who have seized its control from the faculty, could react in a knee-jerk, shambolic, thoughtless manner to "support" that status quo.

('98)
One such case: http://www.businessinsider.com/police-3d-printed-a-dead-mans...
Uber gave me that, too, but only for last month. Lyft have me a flat fare deal for this month, so I use it now.
What is the WTF project?
A story of 18th century attempts to calculate the distance from earth to the sun
Why does the Facebook license try to push an agenda with a perpendicular concern to the open sourcing of Reactjs?
Was the purpose of opensourcing Reactjs a way to not get sued? They lost credibility in my eyes on their intention.
> Open reqs attract hundreds of unqualified applicants, at least, that was my impression.

Matches my experience on the hiring side. Even after we filter heavily long before they get to me, within the last month, had a candidate for a senior software position who literally asked "What is AWS?"

I can only presume that guy files loads of applications and goes on every interview he's offered.
Ad Tech is the problem. There's a tremendous amount of media scholarship which says that advertising itself is also the problem.

See:

Jonathan Albright: "Who Hacked the Election? Ad Tech did. Through “Fake News,” Identity Resolution and Hyper-Personalization"
https://medium.com/@d1gi/who-hacked-the-election-43d4019f705...

Robert McChesney, Communication Revolution (an excellent history of media failures): http://www.worldcat.org/title/communication-revolution-criti...

And, one of my personal favourites, a brief, very readable, and information-packed 1909 account, Hamilton Holt's Commercialism and Journalism: https://archive.org/details/commercialismjou00holtuoft'

As to what to replace this with: treat information as the public good it is:

https://www.reddit.com/r/dredmorbius/comments/1uotb3/a_modes...
> Ms. Ellis, who left the company in 2014, says that almost all of the female software engineers at Google worked in front-end jobs while men worked in back-end roles.

That seems both highly dubious and easy to verify.
Webkit's Web Template Framework https://github.com/WebKit/webkit/tree/master/Source/WTF/wtf
A really incredible achievement. The team created an entire clockless (no central timing) RISC CPU; there's some fascinating implementation details. They created an assembler to convert machine language into ROM macro cells, a C-like higher level language, are working on a more-powerful language, and are creating a GCC backend. Highly recommended for anyone interested in computer architecture.
Then you have to support changing said system and it may make it difficult to change your product as needed. Plus you've got to setup the marketplace, payment processing, add documentation and market to and support third party app developers. Unless you've already reached scale (or have other products that have -- like Google, Facebook, etc), this is probably a dangerous option.
AWS dropped that patent clause a couple of months ago, apparently (https://www.geekwire.com/2017/amazon-web-services-drops-cont...)
Probably the Webkit Template Framework: https://stackoverflow.com/questions/834179/wtf-is-wtf-in-web...
I am more than the checksum of my whorls and curves, sir/madame!
When someone identifies themselves, yes; what about when we identify others through biometry?

The scene I'm reminded of is the on in Minority Report(?) where the main character is walking through a bank of bio-sensing ad displays, and has to not look at them to make sure they can't identify him from his iris/retinas.

As an analogy, imagine you take a picture of someone at an antifa vs. alt-right protest that turns violent.

All the picture tells you is they were there; it doesn't tell you whether they supported antifa, or supported the alt-right; it doesn't tell you if they were there as a police officer trying to keep the peace, or if they were simply trying to get in the front door of their apartment building when a clash broke out outside.

The biometry reveals their presence - it doesn't reveal their intent.
I think it's a common argument for people who think biometrics are a bad idea for security.

IE. You can change your password, you can't change your thumb/face/biometric (easily).

At best, a fingerprint establishes identity, therefore it has more in common with a username, drivers license, social security number, etc. than it has in common with a password.
> I mean, when someone identifies themselves through biometry, there's clearly an element of intent.

If I grab your finger and press it to your device, so that I can access your data, the intent is mine, not yours. Ideally, an auth method works with the intent of the user and only the user. That's his point. You can't grab/cut a passcode out of someones brain and place it on the scanner.
> The set of rules does not appear to unfairly punish any particular language design. You can do object pools in GC'd languages, too, for example.

Actually the rules for the Computer Language Benchmarks Game say about Binary Tree: 'As a practical matter, the myriad ways to custom allocate memory will not be accepted.
Please don't implement your own custom "arena" or "memory pool" or "free list" - they will not be accepted.'
> I disagree. In Coq (without axioms), it is not the case that (λx.2*x) == (λx.x+x), and programs type check fine anyway.

Type checking may be decidable in Coq but now the user has to do the work of putting things into a form that type checks. You're just pushing the problem elsewhere. Even for trivial Coq programs you have to write a large number of proofs compared to how much code you wrote.

> Speaking more generally, one of the desiderata when designing a dependent type system is to set things up so that type checking is a simpler problem than unrestricted theorem proving.

Do you know of any examples of this? I know DML limits you to linear arithmetic so type checking is decidable but that's a big limitation. All other languages like Coq, Idris and Agda require you to write proofs.
Actually taxi apps might have a network effect too. Riders won't download until there are enough drivers, and drivers won't sign up until there are enough riders.
Right. For example, homogenous. Or homonym. Not related to homme or uomo. No connection to homosexual was implied.
Buzzfeed actually do, no matter how much it pains me to admit it, produce some exceptionally high-quality journalism. It's a small subset of their output, but it's there.

One argument is that they're using the dreck to subsidise this. I don't know if that's long-term sustainable, but it's an interesting approach.

There's a long (nearly 200 year) history of this in journalism, dating to the Penny Press of ~1830. See Tim Wu's Attention Merchants.
Do you want the layoffs to be based solely on your union seniority number rather your individual value to the on-going company?
This sound like an Apple Watch feature! Watch removed, or your pulse stops for more than a few minutes, or your pulse goes too high without physical activity (adrenaline), a passcode is required for all devices on next use.
> checking out-of-bound errors at compile time

Even that quickly becomes undecidable as non-linear arithmetic is undecidable.
Android had all my information already stored in it, and I didn't think the improvements Sailfish's UI made were worth making the switch (although they really were very nice). Also, Ubuntu Phone didn't really impress me much, and I think it's kind of a dead end now.

It was a great party trick to be able to dual-boot my phone, I got a lot of mileage out of that one. But it wasn't much more helpful to me than that.
Hey everyone, Ryan X. Charles here, Cofounder & CEO of Yours. Happy to answer any questions.
I was intrigued, until I read that the payment system is in bitcoin cash. I've really lost interest in cryptocurrency over the past couple of years. I don't want to jump through the requisite hoops to manage another digital wallet just for the sake of engaging on an obscure platform that launched its beta 3 weeks ago.

I have nothing against the site, it's an interesting concept. But having to read about whatever recent bitcoin drama is going on to understand its hard forks and implications (BCC is a hard fork, right?), setup and manage a new wallet, take appropriate security precautions, etc, just to manage my site balance is a lot more burdensome than asking for ten cents to comment.
The media should practice more circumspection when reporting about lawyers seeking plaintiffs or suing for class action status or at least mention how it’s a money making endeavour for that lawyer/law firm.

Many of these lawyers are vultures trying to capitalize on topical matters and they rely on this sort of coverage for free marketing, it’s as likely for this to be thrown out as it is for any other outcome, and the media should consider that before obliging with the reputational damage.

Edit: not sure why I'm being downvoted, I don't think I've made any non factual or offensive statements.
Former Facebook ad guru: Russia surprised us [video]
If someone else has a better idea of how to legally become familiar with the program without paying $739 for a Starter Edition license, I'd like to hear it.
Specific to Google: 30% of Reddit users (and about 40% of HN) block Google Analytics.

https://thirtybees.com/blog/ablockers-hurt-seo-strategy/
Coq and similar languages are definitely quite expressive, but they're still complex enough to involve non-trivial manual intervention. Verifying something with Coq is possible but it's hard; whole PhD theses have been written around verifying code for a single program. I know there is some proof-search-based automation available (ie auto), but I understand it's still pretty limited.

Coq, Agda and similar languages are restricted enough to make verification possible, but complex—and expressive—enough to make it very difficult to automate.

The opposite extent would be domain-specific languages that are very restrictive but still powerful enough for their domain. Designing languages like that would let us verify non-trivial properties fully automatically and can save a lot of work for the user, but we end up needing to design a language for each class of task that we care about.

As I said: it's an interesting design problem.

One recent addition to this is the Lean theorem prover, which tries to be similarly powerful and general as Coq but with more provisions for automation via the Z3 SMT solver. I haven't played with it myself but from what I've heard it's a very promising development in making formal verification more accessible to non-experts.
The Starter Edition license is $739, and is available on Linux. I've heard that it can take some work to get them to agree to sell you a copy (liability concerns, or something)
And that's called racism. I don't care if other countries discriminate against us. 2 wrongs don't make a right.

I will not ever support an organization that is outright discriminatory like that, whether it is based on skin color or citizenship.

Also, unions DO indeed prevent people from being hired. That's why right to work laws exist.

Right to work is the idea that if a company hires you, it is illegal for a union to force you to join.

There are companies where you are forced to join the union.

Ex, the screen writers and actors guild require people who work at certain companies to join them.
One of the women suing complained that a man was hired a level above her with the same years of experience. They both had four years experience.

I joined one of the big 4 eight years into my career. Similar to her I was placed at an entry level position. When I started I saw that I had the same ability as people higher than me. I made sure that I displayed that ability to my peers and manager. And what do you know, I got promoted into a more suitable position.

Hiring is broken, we all know this. Sometimes we might not get what we deserve. If we want more then you need to work for it. Plain and simple.

Google can't win with its current culture. This is what happens when a company or group is too left leaning. You always get attacked by the very people you're trying to help.
A few hundred random test cases? Double-precision numbers can have 2,048 different exponents. I've seen multiple bugs that only happen with denormals so you need thousands of tests to have any hope of hitting those.

If you're going to do random testing then you need to have a huge set of special numbers (denormals, NaNs, infinity, zero, exact powers of two, one more or less than exact powers of two) and you should do millions or billions of random numbers. Then you can start to feel confident.
They are as much a password as the key to your house is a password.

And agree that Troy's description is best as it takes us away from unhelpful metaphors.
Scheduling Meetings with Partners and Vendors
US unions are required to have a more combative relationship with management than their German counterparts. There's a USSC decision (the name escapes me at the moment) that makes unions offer equal representation to all. So unless there is criminality, the union can't decide that you are incompetent and should find a new career. From discussions with German union members, they do have that flexibility.
Just tried deepl.com and wow! Impressive for a small company!
Tell HN: Equifax advertising on the radio for credit monitoring services
Heard on the local radio station today a commercial by Equifax offering credit monitoring services to protect you from identity theft resulting from stolen personal information. I was stunned by it. I feel bad for the masses of people who don't know what went down with the data breach and sign up with Equifax.
Yes. The Kohinoor Diamond.

Related: India pushes for return of its “Kohinoor” Diamond Back from Britain => https://news.ycombinator.com/item?id=11542689
The Peculiar Poetry of Paris’s Lost and Found
Would you be able to expand on this? I think the reason your comment is being downvoted is because you haven't backed up your opinion with anything.
They still give that "platform and potential for compemsation" to the long tail, since it's effecively zero-cost to them... it's promotion that is zero-sum. As an advertising company, that attention is all google has to sell. So while they do lose some money from that 50,000 piece of work, they gain much more from the 10 million.

They could have an independent artists section, like the indy corner on their android app store, but which they don't really promote... presumably for the above reason.

It's ironic that YouTube, named in ironic allusion to the denigrating slang term "boob tube" for TV, has become just that, after all.
don't worry, it's finally competitive, so everything will be okay!
Don't worry about it - you can already cash in with any cryptocurrency using our Shapeshift integration. And soon we will have credit card onboarding so you don't have to worry about acquiring crypto at all :)

Note that our app has a built-in Bitcoin Cash wallet, but it works well enough that you don't necessarily realize you are using crypto :)
Would this require end users to factory reset their phone when they buy it (or trust the distribution channel) to ensure that they're not receiving a rooted device?

(Sorry if this question is really misguided, I'm not super familiar with the area).
It was around 10 mins before anything showed up, actually, and 'status1' for a while after that.
This is noise because these lawsuits are common, and Google has deep pockets.

The more interesting investigation is what happens at small companies. For example, look at the early Google employees -- only a few women, and most of those women were not engineers.

Once a company is at Google's size, comp levels and hiring become formulaic. Not to mention that Google is a monopoly, with enough excess cash to settle lawsuits, fire internal bloggers, and pay up underperformers to clean the stats.
Fingerprints are better passwords than no password.

And the hassle of entering even a 4 digit numeric PIN was what Apple was trying to overcome.

Too many people were leaving their phones completely unlocked all the time.
We are far from "few years."
Easiest solution: send BTC to https://shapeshift.io which they will convert to BCC and deposit it directly to whatever address needs to receive BCC. Shapeshift's main feature is to convert between cryptos with the minimum amount of hassle.

Edit: nevermind, I didn't know yours.org had shapeshift integrated.
Keep in mind that because of their scale, jobs that would be considered full stack or back end at other companies are probably considered front end at Google.
Anecdotally, I spent a couple of months this summer going through team selection at Google NYC, with a specific request for back-end, low-level, preferably C++ roles (app security, build systems, etc.). I didn't meet or talk to a single woman through the entire process, with the exception of reception, another candidate, and someone who was covering for my recruiter when he was on vacation. I asked every manager I talked to about diversity on their team, and they all gave wishy-washy answers (at best; one told me that women just weren't interested in his team's work). If I'm remembering right, of the teams that I could have accepted an offer from, exactly one had exactly one woman.

This wasn't the only reason that I ultimately turned down the Google offer (and spent so long in team selection after passing the interview), but it was certainly one of them.

There are some back-end teams at Google that have lots of women; Chrome security comes to mind (I don't know if that's "back-end" in the common sense of the term, but it was the sort of team I was interested in). But I don't find it particularly dubious that these are the exception and not the rule.
I don't want this to sound like it probably does but that's not overly impressive for a place like SV. I mean it sounds like a lot before you calculate cost of living (and it would be a lot here). A good self disciplined developer where I live (accounting for cost of living) would make the north end of that from a not very known company (that's not even a software company). A not great maintenance developer that requires a lot of direction with 5 years experience would make about $150K in SV (adjusted).

I'm pointing this out because it's important for developers to know at least their (adjusted) market value. The taboo about salaries only stands to help employers. Also, it's a negotiating tactic to have the other person throw out the first number, that's why job listings rarely list salaries.

For me, the only way I would gain is to collect a large (adjusted) salary for a few years, keeping my expenses as low as possible (not that easy in SV), then moving back to a lower cost of living area. That doesn't seem to be worth the trouble though.

FWIW, I would expect a prime developer working for one of the big five to make at least double that based on what they contribute to the bottom line. That's not going to happen with the way the negotiation is stacked against an individual.
The apps may be similar but the companies aren't. Specifically, Lyft doesn't seem to be a raging dumpster fire.