skysight-inc/HackerNews huggingface dataset:
Congrats on shipping!

I have a sqlite DB with historical Visa data, and I want to expose it as an API (like your software does), but with API key. Not a python user here, can you tell me about the following?

1. Is it possible to put some security behind the API? So only queries with a key can access it?

2. How would I host this API? Where would the SQLite DB reside?

3. I understand the API is read-only, which is great and works for my use case! Can I also do read-writes to the database from a separate application that will keep updating the database on a nightly basis?
I've got a Samsung S4 laying around that I hadn't used for years (it's 4 1/2 years old). Recently I fired it up just to check some things. As expected, it still runs beautifully for normal Web use across all sites. Other than the small form factor (which some people may prefer), it's easy to see how consumers might stick to older phones.
Consider the demographic.

HINT: Its similar to Reddit's.
In my position if I have to interview a woman (or any candidate), I can talk to her with my team present.

Maybe it would be different if I was the CEO hiring for an executive position, and then I would make an exception. But for white boarding? Even if it were 1 on 1, I don't understand the need to have the door shut.

Privacy makes me uncomfortable anytime in a work environment. I like my home life private, but I'm fine having my work place conversations overheard by others.
For a recent example, Google announced at I/O that it had Android architectural components in beta. They were officially release last week, and can be accessed via AppCompatActivity, and to older Android versions via the support library. For example, the method call getLifecycle(), which is associated with these Android architectural components, is new.
So your argument is that there is no existing problem that needs dealing with.
The most effective way to solve this is to write a set of exploits that work on most devices. Then brick all the phones that are vulnerable.

Surely not nice, but users suddenly got cured of their complete apathy towards mobile phones.
I don't believe that's the kind of feature being talked about. Rather than new controls, I think they're talking more about new things to do.
generally, asking "why am i paying for X if it doesn't..." is effectively saying "the value proposition seems poor to me". it's colloquial and generally rhetorical (or semi-rhetorical).
Nobody is going to mention DailyMotion?
Constant/Migrate/Compute: a workflow partitioning the complexity of code changes
Who, exactly, are our allies right now? As I sit here, I can count them on one hand: UK, France, Germany, Japan and ... ? I’m hard pressed to think of anyone else who would leap to our defense if push came to shove (and Japan might be willing, but not all that able).
How to Opt Out of Equifax Revealing Your Salary History
I was really happy when I found OpenShot, because of it's clean and intuitive interface. Unfortunately it was somewhat unstable at the time (which seems to be fixed by today's patch, yeay!), so I was even more delighted when I found Shotcut, which is also free, open source and cross-platform, has an equally nice interface, but has an even bigger set of features.
I have an old HTC Inspire (circa 2011) I still use in my kitchen to control a stereo system. I'm shocked anything on it still works. It's probably a terrible security vulnerability I should throw away.
You can always keep the totp in a separate keepassxc database. It's not a separate device but unless your threat involves targeted machine access, it's a separate factor.

Keepass2android supports totp as well, and can lock the kdbx secret with the Android secret storage system giving you a little bit of trade-off there if you are interested.

Edit, dug up this post of mine which talks about totp strategies among other things. https://news.ycombinator.com/item?id=15421444
Show HN: Weekend Project:Building a Raspberry Pi Zero Laptop from a Cardboard Box
Does this seem like a trend that goes beyond just tech products? Clothes, appliances, furniture (with fiberboard) all seem to have lower longevity today, whether it's from lacking updates/service or just lacking durability.
Says you. I've experienced it, outdoors in close proximity. People's biology are different. Some people are hyper sensitive, others require massive doses to experience a high. This is true of basically all drugs, btw.
Against Productivity
The immutable thing is pretty key to the whole project - if you do need a writable API there are a few options out there already though. https://github.com/coleifer/sqlite-web looks particularly good.
This is fantastic, thank you. It has everything I needed, I'm going to see if I can migrate from FreeOTP to this. Thanks again.

EDIT: I wrote a short Python script that will migrate your tokens from FreeOTP to andOTP, I have posted it as an issue on the repo: https://github.com/flocke/andOTP/issues/66
> except people cheat.

I never understood this. In a programming / software development job more than any other job, aren't you very likely to fail at delivering on the job, if you cheat on the interview and tests?
A simple improvement would be to use the average life expectancy given a certain age. This can be calculated with the age specific death rates for a population: https://en.m.wikipedia.org/wiki/Life_table
I'm not convinced the risk of job loss due to false accusations is negligible, but it's hard to see how actually trying to make friends with people would increase that risk.
Show HN: Redub – re-dub the audio in a video using subtitles and your mic
http://www.apa.org/monitor/2015/11/marijuana-brain.aspx
I've not considered authentication at all. If you do need that, my preferred option would be to put it behind a proxy such as nginx that can be configured to require authentication.
Do you have any pointers to good documentation on the Alpha memory semantics?

The memory semantics are of course so lax so that the processor doesn't need to check the computed addresses of all in-flight stores before issuing a concurrent memory operation. My understanding is that it's mostly a footgun for assembly programmers, but I'd love to see any estimates of the speed and power efficiency benefits of the lax memory semantics.
> Rome was still primarily a slave/servant based economy, and one based on expansion and conquest. They lacked the mathematical and scientific foundations to radically change metallurgy, chemistry, and the other basics of industry.

The book the article is inspired by[0] is an alternate history set during the reign of Augustus. It takes as its point of departure the capture of Archimedes of Syracuse -- instead of being killed, he is brought back to Rome.

Note that this is the mid-Republic period, before the dynamics of conquest and slavery completely dominated the Roman economy.

The book is written by Helen Dale, who set out to write a legal alt-history, not an economics alt-history per se. She's got the background for it: she's an award-winning novelist, studied classics at Oxford and Roman law at Edinburgh. My gut feeling is that any objection you have, she's thought about already.

[0] https://www.amazon.com/Kingdom-Wicked-Book-One-Rules/dp/0994...
No you can't.

Try it if you don't believe me
So, the actual criteria is is breathing. I'm throwing "pulse" in there because there's no way an ER doc isn't going to check for one.

You're absolutely right that finding a pulse can be tricky (though a carotid or femoral is a lot easier than a radial). There are a handful of good studies that show a fairly high degree of uncertainty, even among well trained providers (ER docs, paramedics, etc). This is why breathing is the "real" criteria, and should have been the decision making criteria used in this case.
I use to use TB for everything but, new corporate requirements mean I can no longer run a rooted phone. Less I use a second phone for work specifically but I have no desire to carry two around with me.

Haven't been able to find a way around of backing up my tokens. Though admittedly the use case is small anyway, the backups are only valid for the device that the backups are from. Though this is by design, of course.
+1. Although I'd call it a post-Trump world. After all that surfaced about Trump's conduct with women during elections, and him STILL getting elected, women are done with it and taking a stand. I believe Weinstein is merely a happy casualty of Trump's election.
Does this help?:

https://medium.com/@IsaacSimpson/urbit-and-the-not-so-dark-f...
Please Help my first video Project Go Viral
This sort of behaviour kills trust among developers. On the other hand apps are using accessibility services for everything except accessibility. Android needs separate APIs and permissions for the things apps use accessibility services.
My Nexus 6P is eligible for 8.0 under the beta program, the last time I checked, 8.0 was still not available for it in the official channel so I had to switch to the beta program to try out 8.0 on a device.
I can't speak to the rest of the content, but I found the introduction in the course accompanying the recently announced gluon library to be both comprehensive and comprehensible at the same time.

http://gluon.mxnet.io/
How about a new craft weed beer? Seriously, hops and cannabis are in the same plant family. I think it would be a great combo if you had a beer made from cannabis with the effects from both.
The problem that you don't notice is the lack of security updates.
> I've got a 7 or 8 year old Google Nexus phone.

There's probably an Android O ROM out there that someone on XDA has compiled for your device.
Looking at Android One devices for the spiritual successor of the utilitarian Nexus 5. No headphone jack is a dealbreaker.
I'm tempted to dust my old Aviator off and repurpose it as a gba emulator or something.
Sure! It is not about renewal, it hit at a different time.

TD;LR (if I remember the details correctly among all the overall bs):

- Changed work location,

- Company notified immigration and joined a check to the amendment,

- Immigration returned the notice because they claimed they did not need such check,

- Company re-submitted the amendment right after, and proved by the way government indeed required a check at the time of submission but might have changed conditions,

- Immigration submitted both a RFE and a NOIR within two days intervals (pretty unfair already imho) claiming H1B petition was violated because government figured (tax filing and flight records) I moved and company failed to tell immigration in due time,

- Company argued that they did indeed notify immigration promptly but that they discarded the initial amendment due to the check,

- Immigration decided to ignore completely and revoke H-1B regardless.

Documented personal achievements and publicized projects should have been way enough to convince any legit immigration officer that my contribution to the country was strictly positive. My personal thoughts? They only care about sending these filthy foreigners back to where they come from (as opposed to 'home'), and they take any covert opportunities to do so.

Company did fill a new petition, but attorneys highly doubt that I am still counted towards the cap. We will have an answer in a few days. Otherwise, we would have to wait a year for the next lottery, at best.

Truly sad and rather stressful event for my wife and I anyways. And she is currently 'stuck' in her PhD (few years to go). Also, because it's been a few years I have not been to the country where I hold nationality, I am treated as a non-resident expat and several rights (such as health insurance, bringing my foreigner wife on a VISA, etc), at least for now. To regain access to these, I would need to stay here for a while, rent a place and find a job.

And finally, the cherry on the 'deportation' cake: company did not tell me about any of these (back and forth took a few months..) until I found out myself just two weeks before immigration took final decision of kicking me out. Might have been a blessing in disguise though.
NRA yearly budget 220-250musd

EFF yearly budget 9musd...and they have a complicated history with active political engagement.

ACLU yearly budget 133musd

Both the EFF and ACLU do a lot more than just privacy. The NRA does one thing...and they are really good at it. They also have language in the constitution they can mis-interpret. For privacy we are left with the abstractness of unenumerated rights.
Ask HN: Could VR be good for vizualizing cloud/software/network architecture?
The Oculus Go looks like it might have potential to be useful for that sort of thing.

Standalone VR optimized because its not a phone too. https://www.oculus.com/go/

I was listening to John Carmack talk about it (fantastic talk by the way if you can spare the time to watch it all) https://www.youtube.com/watch?v=vlYL16-NaOw and I started to think "I wonder how effective it would be to model applications and networks and cloud configurations with one of these...."
I bought Destiny 2 (PS4) around the same time I got Player Unknown's Battlegrounds (PC).

I have about an hour on D2 and 300+ hrs on PUBG.

PUBG is so entertaining I never even made it back to Destiny.

100 online players in each match, dropped on an island, pick up loot(guns, helmets, ammo, attachments), be the last player standing.

It would be interesting to see a write up on PUBG net code.

The dev team sounds new/semi-amateur but I think they have done a great job with the game and the single map that is available (8km x8km).

It's not the best I'm sure, there are optimization issues, lots of cheaters currently, you'll get wiped by hackers 1 out of 10 matches.

But solo is so much fun and Squad and Duo are even more fun. There are discord channels to meet up with fun to play with players.

If you have a decent gaming PC I'd recommend giving it a try.
Security fixes, new features, etc.?
Bitbucket PM here - thanks for sharing this. We definitely have a lot we can improve around PRs and have some folks looking into it now. We'll definitely take your ideas into consideration.

I'm curious about how you use Bitbucket Cloud. Why did you decide to base your dev flow on forks and bookmarks instead of named branches? Are you working as an individual (and accepting PRs on open source or similar) or as part of a team?

Have you given any thought to moving to named branches -- or even git? Are there other problems there that you're trying to avoid? (As you might imagine, that's where the majority of our customers are today, using various branching models on git rather than forks/bookmarks on hg.)
The only impact?

You are a walking vulnerability. KRACK, Blueborne, just to name a few recently highly publicized vulnerabilities.

You are like the perfect exploit, just waiting to get pwned.
You are, Bill Harper.
> What do you mean? Of course this is public knowledge. Anyone accepting an equity grant as an employee who doesn't know this isn't doing their due diligence.

Really. Can you tell me what were the employee gains of facebook, google and twitter on stock divided by the market compensation at the time that the engineers got? Where the engineers back then at every single founding round making a proper decision based on the information they had?

Please.

> Asking about the cap table of a small startup while interviewing is an entirely reasonable thing to do, and I've immediately discounted an interview at a company where they've been cagey about giving me details. I mean, I'm fine with them not breaking it down into what percentage each investor owns, but telling a prospective employee how much of the company in total is owned by VCs vs. founders vs. employees/option pool is pretty uncontroversial.

Its not always available on the decision for the employee. The cost of acquiring that information is orders of magnitude different from the employee than the founders/investors. Its still asymmetry of information, even if it is provided, which it isn't always. In any case, if thats what you believe, then you would have no concerns of making it public, since it already is.

> This doesn't really make sense. You've just described a publicly-traded company, and obviously an early-stage startup can't afford to be one of those.

Why cant it afford to be "one of those"?
Frankly, if the power difference is too great, it's not ethically safe to go into a room alone.

Alone in a room with Putin/Duterte in their homefields, and God knows to what you'd agree. If they coerce you, you might not be believed and, besides, they could have you killed.

Never walk into a room, alone with a dictator.

Or, if you're an 18yo store clerk for American Apparel, never do so w/ the CEO of your company.

And it's unethical to ask a subordinate to expose themselves by joining you, the authority, in such a situation.

... extenuating circumstances aside.
That's not a solution, that is an exploitation of the problem.

The problem is that there are security holes that cannot be patched in the first place. There is no technical reason that for that to be the case, simply an arbitrary one: Manufacturers do not allow users to unlock the bootloader on devices they sell.
Actually, someone posted a very good solution above: https://play.google.com/store/apps/details?id=org.shadowice....

It allows backing up to GPG encrypted files, and seems great overall. It's my new TOTP client of choice.
My bad, I felt I sounded a little passive-aggressive. New on the boards. Let me know your thoughts on the final draft:)
I have a galaxy s2 skyrocket that I use for music in the childrens' room. It's fine as long as I don't reboot it. Takes like 8 reboots to get it to recognize the storage.
> (As trivia, I also notice that iPhone5s on ebay that still have iOS 6 sell for a slightly higher premium.)

This is probably because it has a better jailbreak scene around it than newer versions of iOS. Also, just as an FYI, the latest version of iOS is 11, and they're not numbered using roman numerals.
If you risk losing the old features, that probably doesn't sound too attractive to most people.
I don't know if this is a complete set, but:

1. economic freedom

2. printing press

3. a view of the universe that it follows rules that can be discovered and modeled in the small

4. the scientific method

5. protection of property rights, enforcement of contracts, rule of law rather than corruption
As a counterpoint, the cotton that fueled the textiles industry that drove early industrialization was entirely dependent on slavery. There is no doubt that the cotton gin was the primary economic factor in making slavery in the South profitable, and it's very arguable that, without the massive expansion of cotton cultivation, the textile industry in the early 1800s couldn't have grown as much and couldn't have driven industrialization.
On the other hand I know hundreds of people that this kind of equity made millionaires.
What's your insinuation about being alone with a woman being unsafe? That you don't trust yourself not to do something inappropriate or that you don't trust the woman not to make up a false accusation?

When you go shopping do you take a chaperone so as to keep yourself out of a potentially unsafe shoplifting situation?

We're all always adjacent to a potential crime or difficult situation. But we're not supposed to live in fear of them.
So to explain the background:

1. Helen Dale, a novelist, has written a novel, Kingdom of the Wicked, of which the first book has recently been released[0].

2. It's set in an alternative history, during the time of Augustus.

3. Helen Dale believes an author's intepretation of her work is more meaningful, in a critical or literary sense, than a critic's. So she included an "Author's Note" in her novel, explaining the background leading to its creation.

4. The Author's Note was republished by the Cato Institute on their libertarianism.org website[1].

5. This essay is a reply to the Author's Note.

I've been hosting Helen's website for more than a decade. She is very, very, very smart and a damn good writer. She's also the right person for the right story.

I think you're going to hear a lot about this book in the coming year.

[0] https://www.amazon.com/Kingdom-Wicked-Book-One-Rules/dp/0994...

[1] https://www.libertarianism.org/publications/essays/authors-n...
Public disclosures of these kinds of actions
are meticulously calculated

Are they? All we have is a FB post from one of their entrepreneurs. She probably (sensibly) thinks there’s a better authority for dealing with the situation than the general public.
This ignores the massive amounts of "free" labor that they were receiving from places like India and the Americas. That was a far larger pool than any amount of domestic slavery most of Europe had in previous generations.
> can someone explain the down votes? for real, I thought this was a pretty level headed comment. is it just that I dumped on Samsung?

That's a good question.
I was looking for an interview I heard with someone from this hospital and could not find it, but I did come across this piece with quotes from many of the staff (it's complementary to the submission):

https://hcatodayblog.com/2017/10/06/sunrise-hospital-staff-s...
README is not quiet clear, but for my understanding, lambda is kinda thing that helps you to do serverless, but lambda is also running on some kind of server maintained by AWS, right? fx is kind of lambda, but owned by yourself.
Many Android devices of that age and even newer had flaws resulting in the failure to properly validate HTTPS connections as they would accept invalid certificates. As a result, every time I fire up an off the shelf WiFi Pineapple in public and run SSLSplit (not to be confused with Moxies SSLStrip), I get credential after credential, typically starting with e-mail accounts. This is obviously bad because if someone is using an e-mail account on their phone for banking, an attacker could gain access to account recovery.

These are the sorts of transparent attacks you don't notice and which cannot be mitigated with anti-virus or avoiding downloading sketchy apps. The sketchy stuff is already running on the device in the form of the OS and apps you use within it. Note that a large number of these vectors were never publicly disclosed including a vulnerability with Samsung Knox that I reported. When it was in use, the device would accept any cert.
Not exactly zero-knowledge, just end-to-end. They have the encryption key (called kB), but it's encrypted with a key derived from your password.

(Note, that while the password and key derived from it never normally leave the brwser, the login page is served from the network. So, you trust Mozilla's servers to not get hacked and serve you insecure login page.)

The system also has a notion of "class A" storage, where Mozilla knows the key (called kA), but AFAIK nothing ever used that. Maybe its already gone.

Oh, the device names (and types - like desktop vs android) are not encrypted. Probably because of attempts to add push updates (normally, sync is just polling for updates). And the profile data too (not a part of Sync at all - its Accounts).

Google has optional client-side (also, E2E) encryption, for some types of the data (e.g. passwords and autofill data). One has to opt in explicitly. When opted in, data is encrypted with a key that's is derived form a passphrase you provide (and sync implementations would error and ask you for the passphrase). I'm not sure, but IIRC protocol has provisions that allow to not encrypt some data at client's (= Chrome's) discretion, as the encrypted flag is set per-object. I'm not aware if this is used or not - was a very long while since I've looked at their sync server implementation.

That said, for E2E encryption both system have feature parity, but Mozilla's one has it by design and Google's one only as an opt-in.
Thanks for clarifying -- that makes more sense. Is it possible that casualties were arriving too fast for him to confirm that they had good airways? I have no idea how long that takes.