skysight-inc/HackerNews huggingface dataset:
Didn't Ron/Rand Paul have a proposed bill to limit punitive action on structural crimes (crimes committed structurally due to them being under age): this, alcohol in possession of minor, curfew violations, ... ?
Most mining is the reverse. Travel downhill empty and uphill fill.
I actually think apprenticeships would be a great system for software engineering. I'm in no position to implement it, however.
Even if 100% of electric generation was coal power and regenerative braking wasn't a thing it still makes sense.

Once you get the consumers all using one fuel it's an order of multiple magnitudes easier to then switch out the energy supply with something cleaner.

Until the majority of the world's energy usage is electrified, it's a completely pointless thing to bring up how that electricity is actually generated.
>> there is no need to “heat up” the brakes when descending

I wonder why the journalist chose to use the scare quotes, as if the heating up was metaphorical.
The Supreme Court's role is not to change the laws when they seem unjust, it's to provide a clear and coherent interpretation of them. The Supreme Court oversteps its constitutional bounds when it starts to ask what the law should be rather than what it is.
Yap, yap, yap.
Girls get prosecuted for producing "child" pornography of themselves too.
"All binaries are audited and signed.", which makes it trackable. And the runtime environment is also isolated and uses different set of access permissions. I'm not saying it is impossible. Just layers and layers. For internal stuffs, Google's beyondcorp is a good start.
While that would help it doesn't 'fix' the issue. Unintended pregnancies will happen and you will need a moral framework to deal with them. There is no avoiding the matter.
Patching isn't that hard. Once Equifax finally noticed the intrusion (intrusion detection system?), they took the system down and patched it within a day.
Supreme Court of the state of Washington, actually.
>"it does not solve every single problem therefore it is pointless."

If its something to do with security then yes, it is pointless. It doesn't matter how secure your door is if your window is open.
I'll be 100% honest, I didn't realize Dropbox was still on AWS. You figure at a certain scale it makes more sense to run your own solution.
What does he have to say about cryptocurrencies, and the impending possibility that they might make micropayments a reality?
That's... not how modern crypto works.
If they were doing it right the DB would be encrypted and the PCI fields would be tokenized and then if you get dumps of the DB you don't have anything you can use.
Things one could do that would increase security without hindering business goals:

- PATCHING OF KNOWN CRITICAL SECURITY VULNERABILITIES IMMEDIATELY. This is an architectural decision! If you cannot put out a hotfix within months of a vulnerability being made public, YOUR APPLICATION & DEPLOYMENT DESIGNS ARE BROKEN.

- WAF rules for common attacks and known CVEs

- Least privilege enforced architecturally via stored procedures or microservices or something else so that a vulnerability in one application (the online dispute portal in this case) can't lead to a dump of everyone's PII.

- Data should be encrypted and encryption keys should be stored apart from both the application and the data. Upon startup, the application should make an authenticated request to read the encryption keys into memory. This significantly raises the bar to dumping sensitive data.

- Monitoring for connections transferring anomalous amounts of data

That's just off the top of my head. All of these can be designed into a system and still maintain 100% uptime.
Exactly. There's nothing additional that abortion solves that isn't covered by responsible use of contraception except maybe someone changing their mind or I guess more fairly having their economic situation change such that rearing a child is no longer the socially responsible choice. But I think that's something we're equip to handle via other means (adoption).
Oh, I don't know how I missed that.
It seem that nowadays, people want to err on the side of needlessly ruining lives instead of risking the possibility of life unruined.
> * I have a lot of respect for the Amish, I think they are true hackers. It's pretty amazing the things they build with the resources they have.*

You'll love Low Tech magazine then: http://www.lowtechmagazine.com/
What is the time latency between taking a photo and transmitting the complete data for it?
America is one of the least racist places on planet earth.

Even less racist than almost all of Europe, even the 'fairly progressive' Scandinavian countries - who have 'laws and policies' which are very progressive - but who's culture is so deep, and so fixed, it's really quite difficult for anyone who is not 'Swedish' to actually integrate and participate.

A 'foreigner' has considerably more hope of success in America than in Sweden. Admittedly, a 'foreigner' might have a better hope of a 'decent life' in Sweden, though.

Almost everywhere else in the world is openly and unabashedly racist ... there is only some awareness in situations where there is a peculiar awareness, i.e. 'Euro' vs. 'Metzo' American class issues in South America.
The answer is to take the ISP out of this picture. How did they get in there anyway? You pay the content producer directly.
Yep. You can do all that. At the end of it, a box somewhere needs to be able to access the data. That box has access. You handwave it as single-person-at-a-time queries. But on any given day, they have to run tens or hundreds of thousands of those queries. Even if people aren't accessing their credit info, there is plenty of automation that does. Meaning if you pop that single person query box, you can scale up the queries by a factor of ten without raising any flags directly.

It's much better, certainly. Companies should do that. But it's not obviously a panacea.
Dating as practiced in the Western world is illegal in Iran as far as internet searching shows me. One has to be married to have sex legally.

https://news.vice.com/article/irans-government-is-worried-th...

https://www.theguardian.com/world/2008/dec/29/iran-gender
To have a few horrifically competent go free.
You already know the answer - only US has something as barbaric as "sex offender registry".
Well, mechanization is powered by oil, yes? And genetic engineering could be applied in any case.

In any event, you haven't made an argument that "traditional agriculture" is more efficient than applied ecology (Permaculture is an (the?) exemplar.)

Yield per acre is greater in a Permaculture farm than in a traditional farm, often by as much as an order of magnitude or more. Inputs are fewer too.

More importantly, under Permaculture the soil improves over time, while in traditional agriculture it is degraded and eventually becomes desert or wasteland.
I'm not convinced the Amish could survive without the rest of the US. For one thing, they refuse to serve in the military.

For another, they don't pay much in taxes. My relatives in PA get red in the face whenever you bring up the Amish, because in that area the county relies heavily on taxes levied on your electric bill. The first thing the Amish do when they move into the neighborhood is rip out the electric.

The other thing is there are dozens of sects people lump together as The Amish, and they all have different doctrine. Sometimes very different.
Put machines with sensitive data on a private network. Have one machine/one set of machines connected to both the private network and public network that proxy requests to the data machines. Proxy by parsing original request and then rewriting (i.e. don't just pass along the request). Rate limit and implement notifications on data machines so that if the proxies are compromised, the attacker can't easily do a full data dump. Don't allow remote administration only physical (this rules out this architecture for most companies, but honestly, not a company like equifax with incredibly sensitive info and where network locality is not a big issue).
Some People Are Smoking Scorpions to Get High
Repo Man was a favorite of mine when I was a teenager.
That's a really interesting question.

I'm always on the side of "convicting innocents is wrong" because I consider it a pure civil liberty issue subject to abuse.

However, you are going to have to defend against people doing a "damage amount" calculation. The malicious individuals are so vile and cause so much damage and exploitation while teenage sexting cases are generally sufficiently rare that the calculus probably doesn't come up in your favor.

In addition, I have see firsthand from a bystander position that prosecutors are generally pretty good about teen sexting. I watched as a prosecutor patiently explained to an idiot mother that if he managed to convict the boy in the sexting case, he was also paving the way to convict her daughter of exactly the same thing. So, she could go along, and both of the involved parties would get some relatively innocuous conviction that would go away for both when they became 18, or she could make a big fuss and both of them would be sex offender registrees (the DA was clearly going to uncover evidence of statutory rape along the way--the boy and girl were obviously having sex with each other).

The DA really didn't want the case to go very far. Of course, the DA involved didn't have to bow to religious nutcases to get elected.

The relatives of the mother finally browbeat her into submission, but it was unclear which way it was going to go for quite a while and it could have gone very badly for all parties involved.
It still seems like good investment considering Apple's abundance of those resources.
and Netflix?
With all respect, a lot of design has devolved, and was actually better in the nineties. In my humble and absolutely personal opinion this goes for software UIs, and for cars (exteriors, not technology). Leo is fine. Atom is not (to name a random example, whre not even the technology holds up).

No, I wasn't even young in the nineties. Just youngerish.
I'm a millennial, and it made me sick to read this. It made me glad that I live where I live. I don't live in the suburbs in spite of having my own discrete unit; I live in the suburbs precisely because I have my own discrete unit.

I want my own backyard so that I can go and enjoy sitting by a fire with music I like without ever needing to worry that I might have to compete with others on a cool Friday night in Autumn.

I want my own driveway so that I can go play basketball whenever I feel like, without needing to feel pressured to play nice with others.

I want my own car so that I can drive to and from work in peace, and so that I can do whatever I want in my car, like smoke a cigar. What's the likelihood that my friendly neighborhood ride sharing service will let me do that? Zero. My car is just about the only place left I can smoke in Massachusetts when I'm not at home, and I'm happy to pay for that privilege.

Even if I were OK with all of that, there are numerous dubious claims made in this article about how this new style of living would benefit the environment and would presumably save people from flooding. Really? Would it? How did you figure that? Or does it just sound like it makes sense?

Many signs point to me being stranger than my generational cohorts, but I like the suburbs precisely because I viscerally dislike living in shared spaces.
>> reproduction should be a choice positively made, instead of the default consequence of sex.

Wait what? Reproduction is the default consequence of sex. That's basic biological fact. You can't legislate that away.
USDCHF Remains Vulnerable, Faces Further Downside Pressure
I think on one hand you are correct, but if the court wants to claim that a child is not old enough to consensually produce pornographic imagery of themselves, they must also admit that a child who takes and sends the images to another has not fully developed their reasoning skills.

Same reason that minors usually get a break from the law when committing vandalism, assault, etc.

So they should not get the same exact punishment, which is why I suggested counseling because unnecessary institutionalization of children is a predatory method of creating repeat offenders.
Well what I mean is, I just wonder at the likelihood of the situation being reported in the first place, as well as whether the sentencing would be the same. This isn't any attempt at making a point but just general curiosity.

It's like that episode of Seinfeld where they learn a sex offender moved into the neighborhood and went to confront the person, then found out it was a woman and immediately (and somehow understandably) lost their vitriol.
It was stricken down at the federal level. I believe that laws still exist against it at the state level. Their validity, to my knowledge, has not been questioned as of yet.

However there are such laws which remain, and in fact have been recently introduced, in Canada, England & Wales, Northern Ireland, Rep. of Ireland, New Zealand, Australia, and various European countries.

What's perhaps even more concerning is that even stories are illegal in Canada. The mere possession of the material, i.e a drawing that you made yourself is illegal in England. Publishing a story or even sexual roleplaying with another adult over the Internet might find you sentenced under the Obscene Publications Act.

It's hideous in my view and such laws deserve to be stricken down with ferocity.
The whole history of the web seems to illustrate to me the impossibility of micropayments - they are fairly inextricably wrapped up with DRM, essentially.

But further, there's a very doable "pay stuff as an alternative to ads" approach people talk about occasionally - a multi-newspaper, multi-content-provider "all-your-can-eat" subscription. Charge a rate for each subscriber and divide it among each publication with some multipliers for quality and traffic generation - You'd have a way for publications to get compensated by readers without need for ads.

This kind of tech is certainly doable and readers could certainly be found.

But problem comes from not reader or tech but the newspaper and content providers generally.

A lot of people bemoaning free web content ignore the way that pre-web, long before the web, magazines and newspapers were primarily ad supported. And TV was, of course, entirely ad supported from the start. That was and is the only way to pay for the slick, print fashion magazines you still see and certainly the way to pay for video in it's infancy.

Ad agency essentially can and will pay much more to direct your eyeballs than you will pay for your eyeball's and this situation started long before the web (for most values of 'you', please don't fill reply-space with testamonials other, I know about the other 'you'). The problem of the web for newspapers has been that a previously captive audience roamed free and the papers could no longer serve as its gate keepers - a big problem and one that arguably resulted in a serious loss to journalism. But the "oh nose, we lost our subscribers" complaint doesn't tell the whole story - they wanted their subscribers 'cause they were their subscribers unique influencers, not for the money.

Which brings us back to micropayments, which one assumes the content providers are eager to get, not because they'd generate lots of revenue but because they'd give the content providers an absolutely exact list of their consumers, with Google no longer possessing this key to the kingdom ... of eyeball control.
As Alien is my all-time favorite movie, I am sad to hear this news. Farewell Harry and thank you!
Scale API (S16) Is Hiring ML Engineers, Scaler Ops, and BizOps
This means their EBITDA now probably shows profitability (servers they own are amortizable [the A in EBITDA], where are AWS is expensed.)

Edit: Amortization/Depreciation can <i>generally</i> be used interchangeably.
That isn't true.

https://en.wikipedia.org/wiki/Sex_offender_registry#Sex_offe...
This article isn't an announcement - it's a "Why we did it". They started transitioning years ago.
>who are the identities behind these signatures?

https://maven.apache.org/guides/mini/guide-central-repositor...

"we require you to provide PGP signatures for all your artifacts (all files except checksums), and distribute your public key to a key server like http://pgp.mit.edu."

>anyone can make a signature

The article flip flops on this.

any hacker can do it

it's too much burden for developers

>any malicious package author can point people at a maliciously-owned signature as well

Anyone can also verify ownership of the key before accepting packages signed by it. This is something professionals do. This is something institutions do. This is something three letter agencies do.

>Does such a tool exist

There are CVEs for python. One could even scan a repository using those. Java has prebuilt tools for this. OWASP has the dependency-check plugin for Maven. Nexus uses the same information in their repository health checks.

>have you proposed it as part of pypi's infrastructure? I am sure they'd be interested in that.

Why would I? Given their response to signed packages, I would expect a response along the lines of "Too much burden. Too hard. Not perfect. Not worth it. Security theater. Go away. Ur dumb."

>I'm not sure how the license file of a product impacts the issue of it being malware or not.

It's one of those nice features of good repository management. Do python packages even list licenses? I mean, I assume they would, but then, they actively resist implementing other basic things which I would just assume they could do.

Licenses change over time. Some enterprises treat GPL like a virus. Knowing ReactJS changes from Apache to BSD + Patents in a new version is as important to someone in the business as knowing if a package is compromised.

>it appears to be a closed-source, commercial product

Nexus OSS is open source, Nexus Professional is commercially licensed. The later has a few nice features the former does not. Both can manage PyPi, NPM, Ruby, Docker, Maven, and Nuget repos to name a few.

https://www.sonatype.com/nexus-repository-oss

>I would encourage you to write a comprehensive rebuttal to the blog post you refer towards

It's easier to fool people than to convince them that they have been fooled. -- Mark Twain
I read FAQ for Yours.org. The voting looks like a pyramid scheme:

>You can earn money by voting on good content. Each vote costs 10¢ and the payment is distributed evenly between all earlier voters. Yours Inc. always makes the first vote. You can vote on something as many times as you'd like. You will earn money if you vote on something popular early, because you will get money from all votes after you.[1]

1. https://www.yours.org/about/
Both far extremes are identitarian. Both far extremes advocate violence. Both the Postmodern Left extremists and the Nazi extremists reject logic. Both extremes are collectivist in that both extremes reject the classical Liberal formulation of individual rights. All of the above are facts that you can cite in the writings of thought leaders of both groups.

http://a.co/7HHLSzp

It's true that it's a false equivalence between neo-Nazis and Antifa. But crapping on individual human rights in one's political interest is wrong either way, and both groups do that. It doesn't matter if steam is at 220 degrees or 440 degrees. It's going to scald you either way. It doesn't matter how bad, so much as that both are bad!
Science didn't fail and actually helps a lot here. We know the brain development level of fetus at different stages. As a society we're generally ok with killing fish, reptiles and most of the society is ok with killing mammals. That places abortion cut-off anywhere between 3 and 6 months for the current state of the society moral development. And that is what most of the states have when they aren't dominated by anti-science organizations, ie when it isn't the situation of Catholic Church and Ireland for example.

Basically it boils down to what intelligence level we're ok to kill. Those pro-lifers chewing that juicy steak can't be more oxymoronic and hypocritical.
I feel there's a couple of places where this doesn't reflect reality.

The first very likely scenario is given business logic says a web server application needs certain data, where "certain" is "pretty much all of it". So your application server in that DMZ has a database credential it needfully holds.

Which in turn is a credential an attacker can use to access "pretty much everything".

single person at a time

The majority of modern web applications will open a series of database connections. One application server limited to one DB connection for a public application is probably going to break the app.

Overall, security people don't get the choice about "bowing" to business people in most of my experiences. I'm not saying scape goating never happens, but this

then just be clear that you are getting fired when the shit hits the fan.

What do you think the alternative is? Tell them you're quitting early on because they won't do what you say?

I can present risks, and offer mitigations. More often than not, some get through easily, some never will, and it's those on the fence you work on constantly improving.
Hey, thanks for writing! Love tarsnap and scrypt :)

Just utterly amazing. Hentai is now child porn. How many hentai pictures are stored on Tarsnap??!

Those images might be stored on US servers. Time for you to grant a "backdoor" to the government.

If I was in your position, I would be genuinely confused when trying to juggle all of these regulatory threat matrices :( :(
Conceivably, the attackers spent the 75 days downloading the 143,000,000 records, 2,000,000 records per day, and managed to trigger no scaling alarms as a result. Or perhaps there were no alarms. I wonder if we'll ever know.
My friend's grandfather was 21 and his grandmother was 15 when they first started dating. Needless to say if laws were as crazy back then as they are now my friend wouldn't exist as his grandfather would have been on a registry and in prison instead of starting a family and a 60 year long marriage.
I think the abortion discussion is much easier than its made out. I like Peter Singers approach to ethics which sets the goal to be avoiding of suffering. Now the question is easy: at what stage of the pregnancy can the being suffer?

The entire abortion conversation is completely ruined by most people wearing glasses colored with existence bias.
They run BGP and do an enormous amount of IX peering. https://www.peeringdb.com/asn/2906

AWS doesn't even let you do BGP. If you want to use them for a CDN, you're monopolized into their network and their blend of ridiculously overpriced bandwidth.

They might be using AWS for the canonical store of data, but the sanity of using "the cloud" goes out the window the second you need to ship a lot of traffic to the public internet.
> just be clear that you are getting fired when the shit hits the fan.

How many jobs are out there for people who tell the "business" people what they want to hear, versus people who tell them hard truths about security? How many businesses succeed despite lax security -- gambling irresponsibly, yet winning?
Um, what is this crap? When did they actually move? How long did it take?

The title of this HN link leads you to believe this is recent, but the article makes it seem like a multi-year effort, that in fact, could have finished a long time ago.
Are adults actively seeking child pornography more common than teens experimenting? If that is true it would be a little disgusting/terrifying
If you're maintaining old-school apps in old languages, or you don't have a degree.

If you're talented, have marketable skills and an ability to promote yourself, you should be making at least 70k in most Canadian cities. Given the job market and cost of living increases in the last few years, this isn't particularly high.

Anyone settling for 40k or so (and not fresh out of school) I think should take a close look at other opportunities.