skysight-inc/HackerNews huggingface dataset:
Ask HN: Will Mick Jagger face the music for taking advantage of his position?
And all the other rockstars who have used their position of power for exploitative personal gain?
Sometimes you can retroactively undo being Gotten by just not paying.
So it is! Thank you!

board game geek suggests there's at least one reimplementation: "Sunken Sailor"

https://boardgamegeek.com/boardgame/135779/fake-artist-goes-...
https://boardgamegeek.com/boardgame/233994/sunken-sailor
At Google, you get extra pay for off-hours oncall.
Don't we already carry them in our pockets?
I wish Groupon would just die. They are not solving any problems, just creating them.
The guy already checked out Powershell: https://github.com/ilyash/ngs#have-you-heard-of-project-x-ho...
If you are worried that a home hub will spy on you, then you should be way more worried your phone will do the same thing.

A lot of phones already listen to audio nonstop. Take the Android phones that listen to "OK Google" or the Apple phones that respond to "Hey Siri". Those features require the phone to listen to and process audio nonstop. Sure, if you don't like that then you can turn it off, but I don't understand why people have concerns about stationary always-listening devices moreso than phones with the same functionality. These base stations or hubs are the same concept, except they're present in a room instead of part of your phone.

All other things equal, I think mobile phones are a much greater threat vector than home hubs. Mobile phones are juicy targets with large, complex attack surface areas. See the various remote code execution exploits in Android that could be triggered by sending someone a message. See the various high levels of privilege that applications have that can be used to spy on you. Did you see the article about how Uber had secret privileges that allowed the app to record iPhone screens? [1]

There are multiple reasons why an attacker would want to compromise your phone (e.g. to steal your data, not just record your voice). Many people have phones, so sophisticated adversaries are more likely to invest the energy into developing attacks. There's a lot more to compromise (apps). Home hubs are less likely to see that same level of scrutiny, and they're less likely to be vulnerable to the same types of attacks and issues because they're much simpler devices (they don't run "apps", they don't communicate on the network except with their vendor).

If you're worried about being spied on, then you should also be worried about other people's phones, which you may not even realize are in the room with you! By comparison it tends to be pretty obvious / known to everyone when there's a home hub present in a room. Your phone probably doesn't have a hardware-level light that tells you when it's recording you, like your home hub does. The list goes on.

[1] http://bgr.com/2017/10/05/uber-app-privacy-issues-iphone-scr...
Yes. It is, forgive me for being blunt, nearly completely wrong.

For starters, there's two different kinds of keys in use: symmetric and asymmetric. The ratio of "bits" to "strength" is completely different for the two categories.

Asymmetric keys are typically only used to handle identity, then bootstrap a selection of symmetric keys (which are faster to use, generally); and then the symmetric keys used are typically based on Diffie Hellman key exchange, which is a whole 'nother ball of wax.

Which bits you have to hold onto, and what you get when you compromise them, is not a flat field. Compromising the asymmetric keys used for identity at the beginning of communication means you can forge that identity in the future; but it doesn't necessarily mean you get to compromise other communications made with yet other keys which were merely agreed upon under the situational aegis of those asymmetric keys at a previous date.
> What I am arguing against is saying a typesafe language obviates the need for ecc memory.

Which isn't what anyone said: I claimed you can do ECC in software and that type systems assist with that by making a clean interface and verifying the full implementation. (Since ECC is really just a lift of normal functions.)

There's little difference between using 9 bits in hardware and 9 bits in software, except that you need to cleanly load your ECC code onto CPU cache and you're using CPU instructions per byte loaded. The reason we do ECC in hardware is efficiency on an operation we're doing on literally every byte.

Lots of systems, eg harddrives, use ECC in their actual formats too, because you can do more complex ECC at the software level and not merely the extra bit. Sometimes, this software ECC is more efficient than hardware based ECC would be, because we're okay with less than 12.5% redundancy as long as we can still correct the errors we expect to find.
Thanks for pointing to Begins!

I suspect some of this is just a difference in background or culture; shell conditionals look completely obvious and intuitive to me, and I'm pretty sure my team can handle shell better than python.
I also remember playing this! We also had an alternate version where you place your pen vertically at some point and then push down on it so that it slides in the desired direction. The end of the resulting ink trail is where you start your next turn. Of course it's quite possible to crash into a wall if you're not careful.
I don't know dang? I am not sure the commenter could have got his point across in a more reserved and less flame inducing way? Are you simply saying that the topic is so dangerous that we are simply not allowed to even talk about this?
My essential django package list
The NSA is angry that their toys were lost because of their incompetence of using a tool that was just doing its job (to find malware) on a system that also hosted their secret toys.
They're even more angry that they didn't notice themselves so their buddies from Israel had to tell them. _That_ must have burned.

Since the cover-up among relevant folks failed, and since Russia is slowly elevated to "not really friendly" status again by the US gov't, there's a great opportunity by the US deep state to send a big f*ck you to Kaspersky for their impertinence of doing their job.
Interesting article but has nothing to do with «Unsafeness». (better wording: Promise implementations leak on the heap)
I hate them all equally.
in a similar vein (though also completely different), here's the game of life in APL:

https://www.youtube.com/watch?v=a9xAKttWgP4

This is one of my favorite screencasts. I would have a hard time reproducing this thought process, so it feels much more like watching a speed run than a tutorial.

Would be interested in seeing the APL version of this blog post
In Canada, the provinces often force cities to amalgamate. Is this not possible in the US?
This is not meant to be rude or upsetting. Please interpret this in a positive and optimistic light.

You're in a tough spot, when you have the time that is not better spent dealing with it, review your decision that got you into that tough spot. Be brutal with yourself, were the decisions reasonable? Did you make them actively or did they just sort of happen? Should you have prepared differently? Did you stop and consider it? Should you have done the research you're trying to crash with this question months ago at least? Did you make assumptions that have turned out to be horribly wrong?

Assess it from the point of view of how you can make these and any other similar decisions in your life, better.

Keep yourself, your family, any people safe first and foremost, everything else is just stuff. Even if it's irreplaceable for sentimental reasons it's still just a bunch of things.

Get everything else you can out of this. It's a major opportunity to review how you make decisions and why that can really help you improve that skill. Improving that skill is amazingly valuable to your family, friends and neighbours. You might tell this story to Forbes one day...
There's no reason you can't orchestrate awk and other tools from python though. (I doubt I'm the only one that's done that before).
The bar code reads: 86 86 86 69 29 69.
How would giving an example hurt? You've given away your strategy, a specific example of one of your successes wouldn't hurt you as they'd have recovered their stock price now.
Digital Transformation Journey of an Organization
I'm not arguing against hardware interlocks.

I'm saying that's a weird example to pick of a case against type systems (eg, by asking how they'd have helped prevent that issue), since in that particular case, it actually sounds like a type system would have caught the software glitch that caused the issue.
Thanks for your reply! Please feel free to email me if you want to talk about this more (email is in profile). To reply to your points:

1) I mainly noticed the permalink leading to the "forum" domain instead of the page the user is currently on (like Disqus does).

2) The easiest way would be for me to receive an API key from you beforehand, and send you the user's email if you need that (e.g. to email them), or just a random-looking user ID, along with HMAC((email/id, timestamp), API key). This way you can replay the HMAC and prove that I know the API key I'm authenticating this user with. The timestamp is there to prevent replay attacks later on (e.g. to expire the signature after X minutes).

3) Ah, I got confused because I closed the page at some point and came back, and was getting some errors I don't remember now but that were confusing me at the time. When I realized I can just continue the flow, it worked, but yes, I would have liked it to be a bit more straightforward. I tried to log in with Twitter but you wanted write permissions, so I didn't.

4) Hmm, the way Disqus does it is by linking to https://<theblog>.com/<post>#commentid and then using JS to scroll to the element pointed to by the hash. I don't think message passing is required?

In any case, your system was the most visually pleasing and easy to compose with of the five I've tried, so I'd be quite eager to implement it in a side-project I'm working now. It's at a very early stage, but I'd be glad to give you feedback and pay for the product down the line (although I don't anticipate the project ever making any money or having many users, so I probably won't be able to pay much).
The article mentions they've already found a remotely exploitable security hole. Backdoor or not, nobody wants that.

We would all be fine with IME if we had access to it, could define the keys, and enable/disable features of it. Locking users out of their own hardware is not acceptable. I'm the only one that should be able to remote lock/wipe my phone. It should not be possible for Apple. They shouldn't have the keys. It's my phone. Even if I did trust Apple, I don't trust the government.
Why would a NSA guy use Russian security software?
Not the OP, but .. my smartphone explicitly has NO hotwords that it listens to as far as I can tell. I opt out of this Google stuff as best as I can.

So for me the answer would be that - while my smartphone can certainly listen to things (as every thing with a microphone can. Who covered all the microphones in their laptops?) - a smartphone offers these things as optional features.

For Google Home and Alexa etc.: The 'listen all the time' (for hotwords at least..) is the single use of these devices. And as soon as you buy into this stuff you might as well allow the cloud storage of your recordings for 'better recognition'.

A smartphone could do the same. But it has a lot of value without doing any of that.
> In the case of minor car accidents it does seem to be the common practice.

No, it's common practice that you can sue for pretty much anything, not just car accidents. Most of the fraud that I have seen did not involve car accidents but stupid, mundane things like slip and falls or whatever. I also have a customer of mine that is basically a "professional victim" that serially looks for people to sue (this lady's super lazy). I've also seen startups almost go out of business because of software patent trolling. This behavior is not just limited to car accidents, believe me.

> I also feel that insurance companies have raised prices so high it could be argued that you'd be foolish not to do the same.

It can also be argued that the insurance rates are high AS A RESULT OF many lawyers/people are gaming a system that is easily gamed.

> that you'd be foolish not to do the same.

I'd argue that it's ethically wrong to do so.
Looks like @pornin has invested a lot more effort since BearSSL's initial release nearly a year ago, previous HN comments at:

https://news.ycombinator.com/item?id=12863699
Online Digital Signage Software for AppleTV
It'll provoke a mass extinction and make the maximum human population the Earth can support a fraction of what it is now. If the US government finds out Yellowstone is going to erupt in, say, 10 years, it'll have a strong pressure to invade territories considered safe in order to preserve its existence past the eruption. Also, wars to secure supplies for the designated survivor populations should be expected.
Backdoors in every computer is governments wet dream not nightmare.
Pretty cool and informative!

Just thought I'd say that it's possible to the see the IP you are connecting to. Not sure if you'd like to update the video or not.
Since I use a randomly generated password stored in a password manager, I'd much rather they store my single-site-use random password.
Hauling rocks doesn't really impart a whole lot of information. If they are going to include a bit about hauling rocks, maybe tell us about it - instead of pretending it's a novel with bison and bears. You know, science journalism.

NYT is a lousy source for science journalism. How about what kind of rock? How about why they were moving rock (heavy?) instead of just taking small samples? Bison, bears, and the hot sun are prose for op-eds and novels, not an article about geology.

Heck, they could have skipped that whole sentence and it'd have been fine. I'm not outraged, it's just lousy science journalism that is an example of their continued low-quality reporting. It's just one more strike against them, so I figured I'd mention it and offer readers a second article - which wasn't much better but you can combine the two and almost have something worth reading.
I think a Mac would work too, but that relies on trusting individuals.
>Is it really worthwhile to the contractors or have they no better options?

It could be either, or both.

I don't think it is moral to remove someone's natural rights to fight over resources in a world where there we all inherit at birth (as opposed to produce) a world with more than enough wealth for everyone, and then tell them they must serve some market interests to survive. That's why I have supported basic income for over 10 years now.

Once BI solves those problems, yea, it's fair.

>Does society benefit in amount of 50 billion dollars from Uber?

I'm not sure on the exact amount, but the beauty of free markets is the freedom to choose. If people are voluntarily giving their money for something, than it is >= wortht it for them.
Just construct a giant bowl on top of the volcano to collect the ash and lava.
Money buys ads and people to dig up dirt on opposing side. So in a way, it does buy elections.
Standard intelligence practice is to assume that your information is already compromised. All it takes is a mole, or a disgruntled employee and all the cybersecurity in the world is naught. You'd be foolish to think anything else.
Node js Developers
Like anything it has it's pros and cons. For some thing it's the best IDE out there and for others not so great. Xcode 9's speed improvements to the editor are fantastic, but stability has been an issue for me at least.
I'm using it like that as well, It's a really nice experience once you convince all the applications using ssh to use the gpg-agent's socket.

Have you enabled any other yubikey features while having all you gpg + ssh keys on it? Like for using U2F? I'm a bit scared I'll wipe my key ('-_-).
I use this. I think it's not really for the developer, but rather for the Google Analytics guys. Add Analytics and Search Console data. Works great to get it out of the standard interface and make it more accessible for clients; what content is most popular? Is it moving up/down compared with the same timeframe before it? How are my pageviews/sessions doing? (Compared to previous), Avg. Time spend on site, % of sessions with search, up/down, what did they search for on my site? Where's my traffic coming from? How are the social channels performing? Whats the % desktop/mobile/tablet? How many impressions/clicks did the site make? Whats the site's CTR (and per search term)? Show the trends for the average position in Google, and so on...
The problem is it is clear Guido doesn't like functional programming -- his official statement is that "filter and map should die and be subsumed into list comprehensions". Yes, list comprehensions can do many of the things you can do with map/filter/reduce, but in a way where the functional idiom is obscured and one which is not easily converted to and from other languages.
>If a population is too poor to support its municipal costs, the solution cannot be to let the suburb rot. There is no creative destruction option. If you let the suburb rot, all you’ll have is a more rotten suburb.

A rotten suburb is not a problem if nobody lives in it.
I use visual programming all the time. On my whiteboard.
The task to convert that into code is trivial. Only manual labour.

If I could stay on the whiteboard with my pen and compile parts of my program from there, that would be awesome.

Btw: I tried some "Smart" Whiteboards, but they are all just bad quality. Real whiteboards are still superior for whatever you do with whiteboarsd.
Ask HN: How can we improve our website onboarding process?
Hello,

Recently we've added onboarding process to our blogging platform where user have to pass 3 steps to join:

1. Enter the blog name/address.

2. Choose a theme for their blog.

3. Enter email and password.

We tried to make the process simple as possible without needing to ask lots of questions and adding extra steps.

Once user passes the steps, he/she will login automatically into the blog dashboard to start. There's no hard email verification, user will be able to create posts in draft mode but cannot publish them until the email verification is done.

I'd like to know what do you think about the design and the process and how can we improve it.

Registration wizard: https://dash.gonevis.com/#!/

The main website is at https://www.gonevis.com/

Thanks
Electrons surfing on a laser beam
What do they say when you ask them that question?
I thought British local government was a mess, but it seems US local government is much worse.

One thing that jumps out as soon as you look at a map is that East Cleveland isn't a geographically distinct built-up-area. It's not really a city of its own, I suspect much of its employment comes from Cleveland proper.

It seems to me that a lot of these urban sprawls should be merged into what the UK would call "unitary authorities", which could then better make area-wide planning decisions.
What does “nerfing” mean?
"rarely directly financed"

Suburbs, sprawl are subsidized by urban areas. By zip code, county, state, region.
This is the real answer here. For the only alternatives you're forced to trust yet another party and with something like AV that basically equates to the third party having full control over your machine should they decide to do so. At least with Windows Defender you aren't adding another adversary although it seems pretty hypocritical to avoid American AV while still using an OS that the NSA can push updates to.

Get Windows Ten should have been an eye opener for everyone, vetting updates isn't anywhere close to good enough, if Microsoft is compelled to do so they can run whatever they want on your computer.
Thank you for watching :)
Why would an NSA guy put secret government tools on his personal laptop?
If you're looking for more noise to get you out of your music comfort zone then check out JQBX (https://www.jqbx.fm). It's a social music app that let's you DJ and listen to music with others in virtual rooms (similar to turntable). It plays all audio through Spotify so you get a huge library, can save tracks for later, and the random plays can seed your new discover weekly playlists (or you can use private mode so it won't).
I would change the font to sans-serif
Blueprint sucks balls, it's super slow at runtime, it's slow to create logic, and it makes your game code unmaintainable and almost impossible to reason about. Not to mention you can't diff changes.

PlayMaker for Unity has the same problems.

Friends don't let friends use tools like that.
If performance is your issue then use RPerl with your existing code.

For more info, see http://rperl.org/performance_benchmarks_nbody.html
Democracy is built on premise that people allowed to vote can form their own opinions in an objective way. Obviously that's not true. People can be influenced in many ways, especially those with lower IQ. The most popular way is to include them in some kind of collective which is supposed to have the same opinion on unrelated things (like black should automatically vote for black president or gays should vote for all LGBTQ advocates)

Democracy isn't actually a real concept that makes any sense but it's a collective delusion which works just like any other social norm (e.g. progressive taxes) - it makes people think they are in charge and have a whip against those in power or with money.

It's only about one party losing influencing position and another gaining because there's a threat to status quo.
Trump got billions in free air time, whenever he said something outrageous. It's kinda silly, but he makes good money, because people that hate him, watch him, so the news station are forced to cover him.

https://www.youtube.com/watch?v=9Tji1g0WrPw
(also a non-american)

Unfortunately it seems that the macro politics is very important here - it affects the issue of whether people outside the area care about what happens in the area.
I think you're the one being more reckless with language here. But please, what does "breach" mean to you?

I count it as "inappropriate and unauthorised access to data". Where "access" is potential, not necessarily actual unless you can absolutely prove there was no access.

These third parties have had access to sensitive data they shouldn't. That's a breach in my book.

Neither you or Circle CI even can say this hasn't lead to current or past third parties —or their rogue developers, or people who have hacked them— gaining source access or customer data from Circle CI users. Why? You simply don't know what was running at any given point.

Auditing and sub-resource integrity would help in the future, but it's too late. Unknown people have had access. Only the Circle CI users will know what ramifications that could have on them.

If your argument is anything more than a redefinition of "breach", please explain why you're being so nonchalant (and why you think I'm being "ridiculous") about this.
No, he pleaded guilty to making false statements, not to leaking Stuxnet. More specifically, he admitted to providing classified information to reporters in 2012, over a year after Stuxnet was identified.

Now, whether or not he was guilty of more than that, I don't think we know, but that's often the nature of plea deals.
White flight wasn’t just hysteria or racism at the individual level. It was driven by federal policy back in the New Deal era.

In most cases, it was very dumb on any metric to stay in the city if you had the means to move.
Perhaps it seems superficial, but one of the reasons I don't like PowerShell is because the language is ugly.

There is something about using capital letters for commands that really bothers me. It may be an OCD thing, bc I use lower-case snake_case for all variable/class names in Lisp, C, C++, and Python.

I don't usually do any work on Windows, but when something came up where some scripting had to be done, I just installed the Cygwin and was done with it.