skysight-inc/HackerNews huggingface dataset:
Whenever I see a C networking library, my first questions are:

1. How many security-critical CVEs has it had in the past?

2. How extensively has it been fuzzed?

3. Is this one of the rare C code bases that actually has pretty solid security (like Dovecot https://www.helpnetsecurity.com/2017/01/17/dovecot-security-... or various OpenBSD tools)?

I ask because once upon a time I just about broke my heart trying to write secure networking code in C. I inspected every line. I chose my dependencies carefully. I wrote extensive, malicious tests with tons of malformed data. I added recursion limits to prevent stack overflow. I ran everything through Electric Fence and used the best open source validation tools available in 2001. And despite months of effort for a very simple protocol, I wound up being affected by at least 6 CVEs in 15 years (http://people.canonical.com/~ubuntu-security/cve/pkg/xmlrpc-...), many of them in the third-party XML parser I used. But if somebody directly fuzzed my code, I bet they'd find at least one more issue somewhere.

There are a few people I trust to write mostly secure networking software in C. But the more time I spend fuzzing protocol parsers, the more I realize that—even though I like to think I'm unusually careful and paranoid—I'll never be one of those people.

So how does libhttp look from a security perspective? If it's truly paranoid and thoroughly fuzzed, it might be very useful for embedded work.
Let's Build Magento Mobile App with Ease – MobiCommerce
Building a Magento Mobile App was never been easier before. Let your app created as easy as steps 1-2-3.

Get Started with MobiCommerce for Free...https://www.mobicommerce.net/magento-mobile-app/
I guess if you set the bar for what you want to accomplish at barely above "nobody is allowed to encrypt anything, ever." Nobody would knowingly use such a scheme. It's also a security hole giving access to anyone with the key, which is sure to be leaked/compromised if shared with the entire DOJ and others. Also, once the key is compromised, everything in the past that was ever encrypted is now readable by anyone.
I'm trying to read all novels that won the Nebula Awards[1]. There is also the Hugo Awards[2].

[1] https://nebulas.sfwa.org/
[2] http://www.thehugoawards.org/
Perhaps a 5* for them is equivalent to a 6x8 jail cell for us. I would imagine they usually get the best service on the planet, not the best service available for average people.
Re:scam
That's not an accurate summary at all. The message of the article is that good CEOs set a direction and then act as an immutable rudder with the aim of ensuring that the organisation stays pointed in that direction.
It’s not wasted breath to say it’s not worth it. The point is that distributed ledgers will not be the future of currency and banking - they’re not worth it. They’ll surely exist as a niche technology or religious artifact for the libertarian set.
The stock exchange matches buyers and sellers. The stock price is the average price the stock was trading that day. You can sell stock at any price but if it's too high you won't have many buyers.
Weekend JavaScript #118 – A weekly digest
Grow your startup with pre-packaged and handpicked marketing gigs
Hey all,

A quick bit of backstory. My name is James and I’ve worked as a growth marketer for the last few years, which has given me an insight into a few issues that companies face when hiring marketers and growing their company. Websites like Upwork and Freelancer are often low quality (unless you do a lot of vetting), and similar competitors have rising prices and still aren’t filling the gap, so I felt there was space for another player.

I launched Growthstore roughly 1 month ago, and we’ve seen a positive reaction since (thankfully). I’m a little hesitant of posting on Hacker News as it’s not particularly high tech, but hopefully that’s OK!

I built Growthstore to be super simple to use and I also wanted to provide top notch communication. Companies that hire marketers like to be kept up to date, so we’re on hand 16hrs per day in order to discuss progress with our customers.

We’ve got a lot more coming in the near future, including more niche gigs, video growth courses and some free content.
I don’t get it.
CME to Place Limits on Bitcoin Futures to Avoid Volatility in Cryptocurrency
US committing crimes does not attract much discussion these days.
Space Shuttle Operational Flight Rules, Volume A (2002) [pdf]
> If the new thing has value, your company's shares should all go up in value by roughly its value.

Should.
You’re describing Mathematica. It’s lovely stuff but a bit of a closed system. And expensive too.
What is the plan for when (not if) that master key leaks?
No, the answer is that while possible, only few people are able to produce sounds that high and loud and even they won't be able to shatter any glass. Fractures in the glass are more important, a glass in perfect condition cannot be destroyed by a singer without amplification.

I actually found the article not clickbaity at all, I knew about the Mythbusters episode and resonant frequencies before but still learned something new.
Examples of one of these microtasks might appeal to both potential developers and business clients. As it is, there is little on your website to explain what it even is, other than a CTA to push me to the next step.

This could also be a useful evaluation/interview tool where the microtasks represent real-world problems, versus the pages of FizzBuzzing and stripped-down tasks currently in vogue.

That said, this personally seems useful to me as I'm working on a scripting/templating language that should vastly simplify fulfilment of these non-codebase dependent tasks, and this gives me a new way of thinking about that.
No, generally there is a debian directory with things like rules, control file, copyright etc.

A .deb is basically a tarball with some manifest information. You can build 'non-standard' packages in this way (also see FPM[1] - which will do this and more rpm etc). However if you ever want to upstream a package, there are guidelines that debian produce around this.

[1] https://github.com/jordansissel/fpm
If they’re only profitable because they are exploiting their workforce essentially evading labour laws, then good, they should be upended.
America’s Wildest Place Is Open for Business
Whether this is a good move remains to be seen. As was said in another comment, this seems more about cementing power than anything else.

A corrupt regime is bad, but sometimes the alternatives are worse. Just look at some of the Arab countries that were once relatively stable yet now are (still) in turmoil after the Arab spring.
That's exactly what I wanted to say. For us, living in flats or houses and owning up to two cars (and no jets), a cell is probably as much of a restriction on our comfort as a luxury hotel room is for a Saudi prince.

That doesn't mean that they shouldn't go to a proper jail if convicted but I'm sure they already feel punished.
Automatic compensation for broadband and landline users
> Leaking the master key (and it will leak) exposes everyone

I agree that it should be assumed that the key will leak but there are plenty of ways to practically mitigate the usefulness of a leaked key.

I mentioned expiring keys already, which is obvious, but there are more sophisticated protocols that can be put in place.

> The target is much bigger, the payoff is much bigger for the bad guys

I don't think this is true. These keys would only be usable with physical access to a device. If you have physical access to the device its hard to imagine a scenario where the easiest route to cracking it would be penetrating a secure government facility.

Let me add that you have to think about security in relative and not absolute terms.

If you trust the government to secure a massive stockpile of NBC weapons, if you trust the government to manage a massive state security apparatus with hundreds of thousands of armed agents deployed domestically, then it is a little silly to draw the line at trusting them with your facebook feed.
Ending the "gig and sharing economy" is a good thing for society.

The sharing economy always was about exploiting workers (and externalizing costs), and this has created an additional cost for society.

For example, DHL’s drivers are "self-employed", as result, in most countries their healthcare is funded by themselves, or by society (instead of the employer), and this means you (and your company) pay more taxes, just so that Uber, DHL, Amazon and co can save money.
Because it is important that everyone understand that SSL is dead and TLS is the replacement. SSL/TLS is forgivable, saying SSL is sort of like writing a headline “How this company uses VHS” when you actually meant Betamax. It’s misleading.
You do realize there's no actual _sharing_ in the "sharing" economy? It's just profit-seeking by professional, if part-time, drivers, "gig" economy describes it much better.
> a macbook with serial number filed off

This really tickled me for some reason. Does he know something that we don't?
> dead-simple algorithms

The most successful models I've ever built have been logistic regression models. If you can rephrase your problem in a way that's amenable to run-of-the-mill statistical techniques, you can frequently achieve much better results than you can with 'deep learning'.
Buku bookmark manager v3.5 released
Functional core.async implementation
haha yep, as the creator of this site I'm now trying to figure out the best way to keep the fun stuff while also keeping the site helpful.

for about 20 minutes at the beginning of the HN traffic there was a beautiful moment of 100% real posts and supportive comments here. and then...
dire warning: ubuntu for Windows isn't production ready yet
Any reason Intel doesn't just offer IME-free CPUs too? There's obviously interest considering the lengths organisations like Google go to to disable it and Intel supposedly already has such offers for governments.
We have plenty of "proof" and "witnesses" of UFO sightings as well...

I agree that a Mythbusters finding may not be proof of the highest calibre but they do go through a lot of effort to avoid false positives/negatives.
Though actual gamification, as well as Stack Overflow and Github integration could be useful here.

There might be a role for a go-to programmer for a specific type of task, or somebody that would be really good at delegating to a specific sub-team, this could even be extended to Scrum-as-a-service as has been tried by a couple of companies now.

This could be built up organically based on reputation and completion of a specific type of task or using experience using a specific technology.

It would also be neat to be able to pick up a more complete task like building an app to spec and then sub-task out the HTML and/or CSS to somebody with more UX talent but less application development skills (not everybody is or should be a full-stack developer.)

I personally know a few people that are killer at UX/UI and barely competent in JQuery, so I would love to hand one of them the task of building a React component from a scaffold with all it's CSS goodness, or taking some that I built and constructing a well-ordered page around them.
Let me explain: people who have a chance to steal (or another word) will do so. Of course will I get caught, chances of that, possible stealing...will be calculated.

Some steal little, some steal as much as the can. Some will get caught, others will get medals
Hardly a surprise a contractor in the UK, I need to be careful I'm not suddenly a "disguised employee". Uber do genuine independent contractors no favours. I don't blame Uber. I blame successive UK govts. who won't make the law clear and just let the courts decide on a case-by-case basis. My biggest fear is that they'll come done hard on all contractors IT Consultants through to taxi drivers.
The article says drivers are entitled to minimum wage. I thought Uber drivers choose their own hours so I don't see how this will work?
So did the CIA hack the DNC’s servers or what?
I remember reading something similar about a year ago. Did anything come of those reports?
After the last year, I assume anything WikiLeaks releases is /at least/ contextually misleading.
Um, what exactly is the difference between self-employed person paying their healthcare insurance, and someone being employed and the company paying their insurance?

As long as the self-employed person doesn't pay tax on their insurance (which AFAIK they don't), it is exactly the same thing.
Yeah, I really don't understand how a minimum wage is applicable to this type of work where "hours" make no sense.
Agree with all the points sdrothrock made. I lived in Japan for 5 years first via working holiday visa and then through a spousal visa after marrying my wife who is Japanese. After getting married, all I needed to do was take the marriage certificate to the immigration office and was pretty much instantly approved for a 3 year visa. I guess the train of thought is "Well, if one of our own approves of you, that's good enough for us."

Getting PR in Japan is pretty much just a matter of having lived there for 5 years and not have broken any laws.

Compare that to when my wife immigrated to Canada. Despite her speaking English, coming from an economically developed country, having a University degree and years of professional work experience we still needed to wait for over a year and it cost $2000 for everything involved.

If you want to work and live in Japan, legally speaking, it's incredibly easy. The difficulty of integrating into society is the tough part. Even with a fluent grasp of the language, you'll always be an outsider.

To say "Japan doesn't really want immigrants" is kind of accurate though. Japan relies on its closer culture to keep immigration low even though it may be more subconsciously and not a formal government policy.
Can someone explain like I have a degree in computer science from a good university, but opted for a career as a software engineer in some relatively high level languages?
Uber drivers strike during Web Summit 2017 in Portugal
I don't know. I think this is another demonstration of Saudi Arabia's unfair and unjust society than how you're portraying it.
I think my original point about wine was misunderstood. Good wine is not good because it is scarce, it is good because it is good, but it is more expensive because it is scarce.

If you could produce infinite quantities of Chateau-Petrus, it would be extremely cheap. But since it depends on being produced at a specific location, with a specific know-how, the quantities are limited. In this case, the amount of labour involved has little effect on the price of the wine.
Mini Stuffed Potato Skins
No, a lot of gig economy companies employ their people either directly or through third party. It's not problem. It's just that Uber has this fix idea of never hiring anyone. It's stupid.
If you have rarer skills maybe. Often times you won't have competition for positions, and often times the parent company will be a multinational so you will have some support to get paperwork through (maybe with some delay at the lower levels). Some of the immigration systems are literally set up to make rural areas have some extra leeway or less competition for foreign workers.

For IT administering old, rare, industrial, and strange technology.

For mechanical skillS heavy equipment repair, tool and die cast, quarry and lumber work, or similar.
Indeed! A workforce they are straight up using & will be kicked to the curb once they get their fleets of self driving cars on the road.
I don't understand your question. Please clarify.
Lets say I own a single stock of xyz co, stock is at $25 and I as an ambitious seller decide to sell it at $50 and by a stroke of luck someone makes a fat finger error enters a buy order at $50.

will the stock price tick to $50 for that one transaction ?
Discussed previously here: https://news.ycombinator.com/item?id=15656931
PremiumCoding on Indie Hackers
Did Monero exist at the time? It ought to have been possible to just put it in Monero and leave it mixing for years, then pull it out slowly over time.
No, just companies that tries to gain an unfair competitive advantage by avoiding laws that are there to protect workers.

For any company actually following the rules it is good news that companies like Uber aren't allowed to flout them.

You can argue about whether or not these regulations should be there, but as long a they are they need to apply equally across the board.
This is definitely a very legitimate fear and one which I share. I believe that given the changes made in the UK public sector for the 2016/2017 tax year this threat is ever increasing.

You are absolutely correct in laying the blame at successive governments that refuse to make the law clear. Companies such as Uber and Deliveroo do not help the case as they are seen as the examples of how the term freelancer can be abused. Unfortunately I doubt that those in government care to make the distinction between this abuse of the system and genuine IT contractors.
Ok, so just for example - if I steal your car, hide it so no one can find it, go to prison for a year or two, get out.....the car is mine? Or a phone, or money, or pretty much literally anything else? A stolen property remains stolen until it's returned to its owner, it doesn't transfer ownership just because the thief served time.
IR35 guidelines for contractors are clear enough I feel. A lot of longer-term contractors are in fact effectively employees and and benefit from the security and structure of that yet want the tax benefits as well.
No one is being exploited. People choose to work through these platforms because it's the best option available to them. You don't raise employment standards by making low standards illegal. Low paying jobs work for some people because their circumstances don't give them the opportunity to get anything better.

>>It's the best option available to them because Uber's driven out the competition. Like, people choose to work at Walmart because it's the only employer in a fifty mile radius - for example. They can't work for a local store or start their own anymore because everyone's going to Walmart.

We're not talking about a small town here. These are large cities with diverse economies that contain thousands of employers. Uber drivers can do other jobs besides driving.

There is absolutely no evidence at all that Uber has a employer monopoly in the areas it operates, and that this is why people choose to drive for it.

Anecdotally I've heard that a lot of Uber drivers are very happy about being able to drive for Uber. And by anecdotally I don't mean a survey funded by Uber. I mean from internet comments where somebody claims to know someone who drives for Uber and really likes it. Take that for what it's worth.

>>Yes, in fact, we do. A whole lot of practices have ended predominantly due to legal changes

The vast majority of practices ended because the market value of labour increased as a result of growth in per capita productivity.

Any mandatory standard that gets ahead of the prevailing market value of low-skilled labour just creates unemployment, meaning it doesn't raise the standard of employment for the less skilled.

There's no free lunch in economics.

>>Allowing these jobs to undercut competitors that pay properly propagates low paid situations where society end up having to subsidize the behavior of the companies in question because they don't pay livable wages.

It's exactly the opposite. A mandatory minimum wage, like any price floor, leads to unutilized supply, which in the case of labour means greater unemployment. So you're increasing welfare costs by instituting a minimum wage.

The market value of labour doesn't increase because low-paying jobs were made illegal. That's not how supply and demand work.
The minimum wage in the UK isn't a fixed monthly amount. It's a fixed hourly amount. So for someone aged over 25 they should receive £7.50 an hour

The drivers will still be able to set their own hours, just they should be getting a minimum of £7.50 an hour for those they work.
The confusion for many people stems from how security is achieved for blockchains.

Most systems have an identifier and a password, and sometimes 2FA.

For bitcoin, all you have is a 256 bit key. The key points to a 160 bit address (through hashing), and allows signing transaction from that address.

This is true security by statistical obscurity, as you can generate as many keys as you want by brute force, and all of them will match and give you control of a valid address, with a non-zero chance of it being an existing address with a balance. The chance is so low that it is completely acceptable though, at around one in 2^154.

This means the bitcoins people own aren't materialized, you can't delete, download or store them. They are simply a positive balance recorded on the blockchain for an address they control.

There is no cold storage for the coins, as they are always publicly available on the chain, and anyone with a valid key to that address can spend them. The only way to lock them down is to move them to an address that only you control.

When people talk about cold storage, they're talking about the private key. You can generate and store a key on a secured machine / device, allowing you to generate signed transactions for the corresponding address. You then copy that transaction to a internet enabled machine in a secure way, and broadcast the transaction to the network.
Yes, that's the word "should", which I used.
Learn faster by working faster
While I am in no way defending DHL's practices which I think are wrong for other reasons:

How does an employee having to buy their own healthcare mean I pay more tax?

How does DHL buying healthcare for employees mean I pay less tax?

How do either of those affect my socialised healthcare charges which would remain fixed even if DHL cease trading?
I don't get lip-syncing part of it.
Their website says it's "musical.ly is a social media platform for creating and sharing short videos." I think this abstract "short" word explains a lot: Youtube videos lose a lot of views, because Youtube tells how long they are. Impatient kids are like "Nah, it's too long". But by promising the videos are short, you can probably make viewers to spend even more time with an app, watching many shorter videos instead of a long one. No data to prove it, just gut feeling.
This particular submission is a dupe: https://news.ycombinator.com/item?id=15656931

This one has a bit more info (although not much as far as details go): https://news.ycombinator.com/item?id=15668363
Please reconsidering your choice of libraries
How Do We Determine Techniques in Strategic Analysis
Why incompetent people think they're amazing [video]
If I got it right, they got a debugger access to the processor that runs ME, via an USB port.

So they can mess with ME (dump its code, analyze it, observe how it runs, modify it live) as they see fit.
Not sure what your confusion is. Their gross-income divided by hours worked (doing a job or waiting for a job)? I guess they would become zero-hour contract employees, and so have the same statutory protections and benefits as perm employees except with no guaranteed hours? They would be entitled paid holidays for example, and would have a floor on their income proportionate to their hours worked.