skysight-inc/HackerNews huggingface dataset:
It would probably be better to use a survey of vulnerabilities plus Heartbleed instead of just repeating Heartbleed. It can be dismissed as an outlier: "That's just one project everyone was freeloading on." I know, it's a security-critical project that should've gotten many eyeballs. I just prefer to show how pervasive the problem is when debunking this stuff.

The other thing I noted on a Heartbleed-related thread was that FOSS never produced high-assurance security despite its labor advantage. Proprietary sector, either industry or CompSci teams, beat them about every time.

https://www.schneier.com/blog/archives/2014/04/reverse_heart...

I elaborate more in replies to DB. It comes down to them not caring enough to apply the level of QA necessary. You have to pay people to do that. You also have to find the right people that can do it since even the knowledge of it isn't widespread. They'll know 100 frameworks and such but not the basic activities for assurance past unit/acceptance testing and review. They'll probably have never heard of Ada/SPARK or SPIN when they tell you about Rust. So on and so forth.

Raymond's claim is utter bullshit. If you want best security, you're better off buying a 3rd-party-evaluated product from high-assurance proprietary. If you want good security that's cheap, it's a small number of proprietary and FOSS projects whose stakeholders put time in for thorough review and analysis. The rest is shit waiting to happen or (looks at CVE list) happening all the time.
Watching Heartbleed and Cloudbleed happen really drove it home for me. Given that routine programming errors can cause private data to be transmitted unintentionally, I have to question the sanity of writing networking software handling private data in C.
Welcome too late stage capitalism
There are a lot, and NLP us used a lot to describe things that doesn't have anything with it. Self help took it like quantum entanglement and ran with it. So beware of that.

Founder is Richard Bandler and John Grinder, first one is your best source (he rants a lot and often tells same stories). I like approach of Robert Dilts a lot (just giving you keywords got google).

I read a book about it long ago and helped me greatly. I quit smoking, turn my life around. Essentially explains you how you can run your brain.

https://www.amazon.com/NLP-Essential-Guide-Neuro-Linguistic-...

Here is one of the recent discussions with Bandler.
https://www.youtube.com/watch?v=GfTNV6kDAYg

Hope this helps.
Doing that on MacOS would be the death of it. Apple does have the audacity to move towards that direction (OS X already makes you jump through a few hoops with downloaded unsigned apps) but even they know that a lot of their users are developers who need that freedom.
It's already in Firefox Developer Edition.

https://www.mozilla.org/en-US/firefox/developer/
I'm still signed onto AIM - through Pidgin - whenever my personal laptop is open. It's the primary way I stay in contact with friends I made through the early-2000s internet.

Of course we're also connected to each other on more 'modern' social networks, but there's a certain - undeniably nostalgic - appeal to the AIM chat, continued unabated over the same protocol with the same handles for 15+ years.

Funnily enough, just a couple of nights ago someone I hadn't spoken to in at least _10 years_ signed on and messaged me out of the blue. We reminisced on our friendship on a now-forgotten AOL message board back in 2001, and discussed the myriad ways our lives had since changed since then. A surreal and touching exchange that's been running through my head since.

If you once had an AIM account and haven't signed on in a while - which, gauging by the reactions to this thread, seems to describe most of us - log on and see if anyone's still around. Your Buddy List hasn't gone anywhere.
Globalization of scientific collaboration
This is a draft of the release notes for a release which has not happened yet:

Released October 15, 2017

Broken links apparent in the doc as well.
> vim et al are sorta on the verge of being irrelevant even deprecated because there are two things that are getting better: modern languages and IDE's.

I don't spend a ton of time coding any more but do spend a ton of time doing random text editing (properties files, XML, data manipulation, whatever). While I agree that modern IDEs are probably better if you're just doing straight coding I think there will always be a place for a high powered text editor.

Plus, if I'm editing a script on a remote host (random shell script) or just need to make a quick change to something locally then it's much faster/easier to drop into vim than to fire up an IDE.
Perhaps as people who call themselves "engineers" we should move away from the idea that "gets the job done" is good enough? Especially when we have security breaches left right and center.
not updated in a year?
Great reading! i would like to kindly suggest the following:

"The minimum values the error would take can be computed using gradient descent, an optimization algorithm that is capable of finding local minima of a given function"

i think it's better to clarify that gradient descent "can find" global minima, there are some neural networks cost functions that are non convex, in that case the gradient descent can be stuck in local minima, as Andrew Ng explains in his coursera free course is that this local minima normally doesn't represent a big problem in neural networks, but as a general concept the idea behind optimization algorithms in cost functions is to find the global minima, for example in linear regression and logistic regression we have convex cost functions so the Gradient descent can find pretty close values to global minima.

Also i will suggest that the main task of Gradient Descent is not to compute the minimum values the error would take, it's to find the values of W that will get you the minimun error.
There are many, many competitors in this space (visualPing, changeTower, versionista, followThatPage, trackly.io). Most have similar pricing to Dffer, but some are completely free (possibly with worse UI).

I wonder whether this sort of freemium model works, because there are some people who's use case (like mine) absolutely isn't worth spending money on, but I'd like more than 3 checks for free. Obviously I'll take a worse UI that's free over spending money on such a ridiculously simple app. I could literally buy an EC2 instance just to run 10-20 daily cron jobs for less than signing up for Dffer.

My use case is to use trackly.io to see when new firmware/software updates come out for devices I own. But of course, that's never something I'd be willing to pay for.
I've never had a Seagate drive last any reasonable amount of time
I’m glad you enjoyed it ! Attention to detail is always appreciated :)
An "algorithm" is simply a way to do a thing based on a set of rules to be followed... of course it's ambiguous.

Getting scared of anything that generic is silly. Might as well fear the outside because anything can happen out there!
Having worked in the financial industry, your view of it is what we'd call, "50,000" feet.

I don't think it reflects reality on the ground, nor does it really reflect how humans in groups make decisions according to research.

The message network loop issue isn't even an issue for message passing systems except in the most pathological cases (where it results in an unbounded growth in messages or an infinite delta on the values the algorithm calculates.
We use OpenBSD for our firewalls at work.
> A quick script in a cron job could also do this

I love comments like this. You couldn't hope for a better example of "shit's easy syndrome".

Yeah, a quick script in a cron job. Oh, but now we need 2 pages monitored. Now we need 100. Now provide an interface for marketing to add and remove pages. Make sure it emails these N people (different for each page of course!). Oh, this has to be up 24/7 so we'll need a server and monitoring and a test environment and deploy strategy. Your script is giving false positives because of changing asset timestamps. Oh, your script needs to provide a visual indication of what changed and when. Etc etc etc et cetera.

That's why you pay for things like this. Because it's actually a shitload of work.

I recently used a similar site (visualping.com) to score a pair of airpods, which are in tight supply, by watching my local apple store for availability. Worked beautifully. Write my own script, are you kidding?
You can pretty much safely ignore most things coming from 7-digit UIDs and not have to worry about the shills so much.
Link to feature update page with a brief demo: https://www.finfox.co/launch/
How to Lawfully Steal Web Traffic from Competitors
Seeing a dithered image really brings me back to the mid 90's. Seeing a dithered photograph reminds me of the early web or AOL. You used to remove colors from GIFs to save space on web pages, as few as you could as long as the image was still tolerable.

With a 1MB SVGA card, you could pick between 16-bit color at 800x600, or 8-bit (256 colors) @ 1024x768. Did you value higher resolution, or not having to palette shift every time you switch apps?
I never claimed they don't. My commentary was primarily about the importance of distinguishing the two.
> Which would you rather write?

I get your point but I don't think this is a good example. This is the kind of thing you write one, put in your .vimrc, and then never have to think about again. Especially if you're putting your .vimrc in source control and pulling it down automatically into new environments.
Show HN: Modd.io – one minute game maker
Binfer to Non-Binfer User
You can create a Link using 'Create New Link' and send it to anyone you'd like via any communication platform.

You can use the Messages feature to compile an email-like message to an email and a link (similar to the one above) is sent to the user.

Binfer to Binfer
If both users have Binfer installed you can add a contact, and drag and drop them files in a chat message and they appear on their desktop.

You can draft them a message (just like above) and the receiver begins receiving the file.

You can create a sync, using the backup/sync' feature and the folder (same structure and data) is replicated on the receiving end.

Check out the product manual with any more questions. Thanks for the response Colin! help.binfer.com
Silicon Valley’s Russian ads problem, explained
I suppose the 'modern' way to do it would be with org-mode and literate programming.
Great question! It is vaguely similar but different in many important ways. To be clear we do not see Brave as a direct competitor and wish them success. While they have referred to us as competitors, I believe that is a bit of an overreach. First of all, Steem tokens (and the Smart Media Tokens others will be able to launch on top of Steem in the coming months) can be transferred in 3 seconds with zero fees. This enables us to connect money to "likes" or in the case of Steem "upvotes." Brave is a pay-to-play system that uses an Ethereum token which is both slow (10 minutes) and has fees. Steem, on the other hand, is a protocol which anyone can use to build applications that leverage this crypto fuel engagement without adding paywalls or cognitive load. The crowd acts and money flows the most valuable members as determined by the stake-weighted vote of the users. In short, the Steem blockchain is protocol that the Steemit team launched and leveraged to create steemit.com but anyone can use it to fuel their app, INCLUDING apps that serve the same use case as Brave ... but with real-time fee-less transactions (i.e. better). If you'd like to learn a little more about how the system works you can check out the following video featuring yours truly: https://youtu.be/z-V6HnfbGUA

Community Liaison, Steemit
It's fairly easy to modify for your needs though, have a look at the templates: https://github.com/swagger-api/swagger-codegen/tree/master/m...
You can create a copy of that template directory, adjust them and pass it as a parameter to swagger-codegen.
I’ve been a customer for years and recently had a catastrophic failure of a computer and it’s direct attached backup drive. I have spent the last four days waiting for backblaze to create a restore a backup for a computer on and last I checked it was at 9%.

I chatted with support and they said this is normal. That progress may jump to completed any time because the restore only tracks file count.

I wish I could say I’m happy about this but I’m four days into trying to pull down my data and I still have no idea when I’ll be able to start the download.

This sucks.
I don't understand why Apple can't just make the past few releases of OS X available to anyone who needs it. It's a free OS now, and it has tons of hardware checks to prevent it from being run on non-Apple hardware.

I don't understand their need to remove/hide the OS upgrades. I have to repair a friend's older MBP next week, and now I need to jump through hoops to get a legitimate installer.

If you fall more than 1 version of OS X behind and they remove the previous upgrade, you're screwed from upgrading to the latest version.

WHY, Apple?
I could see XCode and Command Line Tools becoming apps. And Homebrew could be an app that let all of its contents run in a sandbox and not touch any of the device's other data.
AIM will be discontinued on December 15, 2017
Social Media 101: How (And How Not) to Use Them
By managed languages I understand memory managed, aka GC languages.

It's not correct to say that they use additional resources to provide memory safety or security.

Python for instance uses additional resources because it simply doesn't have a performant implementation and Java uses additional memory to gain execution speed.

Swift and Rust are memory safe, but don't need a GC, so those memory safety advantages are in fact attainable otherwise.
I think the article would have been much better if the author had left out the section about RN. Failing that I would have liked to see him dig into why RN was slow for his use case and what he tried to do to fix theses issues.

"While it uses the same React paradigm, there’s still a lot of differences.It seems performance is reduced significantly as your application and the react framework is controlling all the high level rendering functions from within a JavaScript control thread."

It really seems like this person didn't spend a lot of time looking into performance when assessing React Native. Facebook have some really nice docs on this:

https://facebook.github.io/react-native/docs/performance.htm...

They have a whole section on how to handle performance for user interactions/animations/etc which is well worth reading. Many RN related performance issues boil down to not being mindful of how javascript interacts with the native bridge. Tal Kol from Wix wrote a really great article about this, which you can find here:

https://hackernoon.com/moving-beyond-animations-to-user-inte...

I'm sure Flutter/Dart are great tools. It's just a little odd to see someone who know's React dismiss RN off handedly for performance reasons without making much of an effort to read the developer docs.
Can you elaborate on the Nest part? How do fault attacks apply to firmware verification?
There are lots of reasons to shift stuff around, and there’s lots of hardware :)
-googler
If a system is so "broken by design", shouldn't it include a flag for running under worst-case mode, so that users can more easily detect faults in their assumptions about the system?
ORM's by and large do protect your from SQL injection attacks.
> assuming you turn the right switches off

That's the problem. I shouldn't have to find the switches in the first place. Plus they constantly keep shuffling the settings around(on other google apps and android too) and I can never find the ones I am looking for.
I'm the only software engineer with good taste in music
You all only listen to shitty music wtf is wrong with you ffs
RED's Monstrous Monstro Sensor Is Here at Long Last
Also, Conventional weapons take great effort.

One guy in N Korea with a nuclear weapon at his disposal vs Cuba and no nuclear weapon and we can see how difficult it is to imagine Cuba posing a real destabilizing threat vs N Korea.

W/o nuclear weapons, N Korea, in order to invade S Korea and overwhelm it would need millions of troops clothed and fed for months, logistical support, etc. A couple of bombs and the same is achieved without spending billions a month in maintaining troop and armaments levels.
Does this work with content that is loaded dynamically with JS? I've used http://www.changedetection.com/ in the past, but it only scrapes the HTML.
https://www.reddit.com/r/firefox/comments/6rpglw/firefox_57_...
> She lit a home-rolled cigarette and, getting to work with a mattock, tried to ignore the weather. She had lately been telling herself that she had to stop taking these risks. They were more than an hour from the nearest hospital, and what if she had another heart attack?

Yeah...she seems to be ignoring the heart-attack risk she is pumping into her lungs while she says that. I get that it's an addiction that is hard to kick, but come on. If you've already had quintuple bypass surgery, maybe it's time to give up smoking?
In the late 1990s when I used AIM, SMS still cost $0.25/message, and few of my friends had any cell phone, let alone one capable of texting.
AIM really was the gold standard for instant notifications and ambient signaling. Away messages were fantastic and if you stayed logged in, non-experts (normals) could disclose and see availability and time idle.

The pseudonymous UIDs, AOL's chat rooms, contact management, image sharing, private messaging—this list of innovations introduced to mainstream users made AIM a giant success.

Alas, AOL Instant Messenger cannot compete in the age of smartphones.

One of my friends with whom I stayed touch first through AIM said

> Somehow I really thought there would be an AIM
> emoji <emoji of man running: UTF-8 \xf0\x9f\x8f\x83\xf0\x9f\x8f\xbb>

I replied

> If any service should have an emoji standard, it’s AIM.

EDIT: formatting, spelling, sense, fix quote, punctuation, proper noun instead of pronoun
Apple removed the Home button after 10 years in the iPhone X and replaced it with a little bar drawn in software at the bottom of the phone. Just like users will learn new behaviors to exit apps, they will learn that the control center behaves in a new way.

Nobody cares about this other than technical people, who really only care because they perceive it to be Apple Arrogance. Nearly 40% of the installed base is on iOS 11, if there were complaints about this we'd have heard about it by now (just like we hear about everything else).

Tech blogs and the EFF might write about it, but aside from the HN threads about it, no one in the real world will ever care because the change is an improvement over what it used to do.
Still? 100PB of HDD is still not big Enough?

So the question would be, In unit of Backblaze, what are the size for Amazon, Apple, Google, Facebook?
I think when you say hermit you mean a recluse (and probably in the OP too), someone who separates themselves from society, if they do it for religious/philosophical reasons then I'd call them a hermit.

Did your friends dad ever get invited to your own parents' house, did he go? Perhaps he just had no friends rather than choosing to be a recluse?

I match the description you give of your friends dad quite well, except without the money. I've one friend who'll send a birthday card, none that will ring me and suggest we hang out; I try to do things for my children to encourage them not to fall in to my pattern (perhaps that's what the pay-per-view was, a treat for his son and you?).

I like people, enjoy shared work to a common goal, get involved when I can with things like helping out at school clubs and Scout events (was previously a leader with Cub Scouts) but somehow things just don't really work; I have social anxieties that inhibit me contacting others but I think I can be reasonably good company.

"Dedicated family men" seem entirely orthogonal to the matter at hand. To me it's an epithet - mostly used for dead people - to say they spent time with their kids and put them before other things like their career.
Link to their blog post on mad dashes to Costco after the floods [1]. It's an engaging read.

[1] https://www.backblaze.com/blog/backblaze_drive_farming/
Thank you so much for the comments! I indeed agree with every word you said. Regarding your suggestions about the main purpose of gradient descent you are right and so I will rephrase this part of the post in order to clarify it. :)
One good thing about a true basic income is that there wouldn't be conditions for receiving it so it would significantly lessen the penalty for working legitimately (obviously there would still be tax reasons to have income you don't need to report). My hope for basic income is that by simplifying how we give aid it can take out much of the ridiculous bureaucracy of it but I'm obviously no expert
Oh AIM. I back in the late 90's it was _the_ async/online communication method for the startup I was working for. The boss would do the interruption thing over aim, we'd have a morning 'standup'.

I remember hooking an Eliza bot to respond to the boss, and it took him far longer than it should have for him to figure it out. Good times.
Disclosure: I didn't like the talk.

In Uncle Bob's view, which I assume has some popularity, unit-tests are a form of software specification. It's informal as the specification can only test specific examples of behavior based on a determined state and the people responsible for its maintenance are the programmers. And if you're not disciplined enough with how you write these tests you end up in a situation where you're writing the rules for your own success and the specification itself contains errors.

I look at specifications as blueprints. If you're planning a sky-scraper or mass transit system you use blueprints. If you're building a shed in your backyard you might just use a quick sketch on a napkin. I think the majority of commercial software is somewhere between napkin and blueprint; building houses to lean on a well-trod analogy.

You need something more specific and robust than a sketch on a napkin but not quite as formal as a blueprint for a rail switching system.

Regardless unit tests are not a very good specification format. They're only going to show you examples where your software meets your requirements. However we all know that software is complex, hard, and systems are more than the sum of their unit test suites: there are operators involved, conditions and constraints on its operation, failure modes. You need a tool to help you design the system and check your work for you because these systems are getting too complex for you to reason about without solid abstractions.

I think Rich Hickey completely missed all of this when he said that in his talk. If we were to modify the analogy to fit the view of testing as described the guardrails would have holes in them. All over the place. You'd only be safe in the cases where the car "bumps" into the correct spots you thought to put a test.

However I do agree that unit tests alone cannot be relied upon as the only way to write "correct" software where "correctness" is determined by it's adherance to its specification and that the implementation of it follows state of the art practices. One has to do more than just use unit tests to achieve that.
Auto complete and install npm modules in Atom projects
I don't understand. B2 is currently about half the cost of S3 for outbound data and 1/4 the cost for data at rest.

What do you mean "stay competitive?"
Fairly brutal for a Jepsen report.

What fascinates me about the now-known-to-be-untrue claims in the Hazelcast documentation is that the claims were made despite the developers having know way of knowing if they were true because they’d not conducted these kinds of tests themselves.

Documentation that reflects what the developers wish were true rather than what is actually true is not a new phenomenon, but is potentially fatal for this kind of software.