skysight-inc/HackerNews huggingface dataset:
How to implement though?

You cant just give Jail-time for data breeches. It would encourage cover ups and scape goats. Also never underestimate just how disorganised large organisations are, incompetence at addressing issues is systemic and goes far beyond data protection. What seems like malice is sometimes just plain stupidity.

It has to be backed by some sort of regulatory framework. Just like a fire code or employment rights. But crafted in a way that it doesnt end up like PCI, ratings agencies or financial auditors. IE creating an industry that sells compliance and not actual security.

Perhaps something light, like mandetory minimum bug-bounty schemes for all companies, where fines (or more) are imposed for not addressing issues and an independant regulator works with larger companies to resolve issues (or penalise the company severely if they deliberately wont).
That comment is from the post, which again, I'd suggest people read instead of a paraphrase.

This is the advice offered to him:

“Therefore,” he continued, “under no circumstances be a gentleman! You must disrespect the girls. Furthermore, the very first rule is, don’t buy a girl anything –– not even a package of cigarettes — until you’ve asked her if she’ll sleep with you, and you’re convinced that she will, and that she’s not lying.”

This is his conclusion to that advice:

The master was right. So the lesson was terrific!

You can take from it whatever you want.
By drinking it ...?
I wonder if maybe it includes components to actually implement UI for things like signin, signout forgot password etc - that would be very helpful.

update: yes that's what it seems to do but appears to be missing forgot password/change password.
And then we can go back to getting ripped off by taxis. I’ve lost more money in taxi rip offs than I ever spent on Uber.

Other than the sexist nonsense of the CEO, there really is an irrational hatred of Uber. Are many of us secretly moonlighting as cab drivers?

Uber’s nonsense is minuscule compared to generations of taxi corruption.

This isn’t me excusing Uber but it does seem like many people, especially Europeans have an inordinate amount of glee over anytime AirBnB or Uber get in trouble. Has the hacker ethic really devolved into statism?

We should be cheering over disruption of the status quo. Does anyone actually long for the days of getting ripped off by over-regulated and over taxed hotels and taxis?

Do you people actually like having government pick winners and losers? Do you actually trust government to do the right thing? Governments have a strong track record of stifling innovation, abridging freedom and giving regulatory handouts to the privileged classes. People here get all kinds of sanctimonious when it comes to patents and copyrights yet seem to fall firmly on the side of the entrenched incumbents when it comes to things like disrupting hotels and taxis. It’s a weird double standard; a hatred of government when they want to prevent people from stealing movies, but a love of government when they want to prop-up taxis and hotels.
My tinnitus is usually not bad enough to be bothersome, but when it gets painful, I listen to https://mynoise.net/NoiseMachines/neuromodulationTonesGenera...

That's not just noise, it does... something... that provides instant relief.

That site also has a great variety of background sounds which you can adjust and combine in myriad ways.
A CEO's Guide to Emacs (2015)
Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source.

In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to source code with secrets in it.
Anyone I guess, it doesn't sound like they had a warrant.
Telling everyone to just move where the jobs are and live like an immigrant within your own country is why Trump got elected, and will by why similar candidates get elected in the future. Economic growth and development shouldn't be limited to only a handful of cities in the country. It's not good for our workers, society, or culture in general.
nah, he was really good at interviewing people and directing interesting longform discussion on a huge variety of topics. better than pretty much anyone else.
I was hoping this was about the old FOSSIL driver.
I love fossil but I have so few opportunities to use it. Almost every project is on Github with a minority on bitbucket or gitlab and sharing code outside of those gardens (or even between them) always feels like an uphill battle. I've had to answer the "why not just use github?" question a lot of times. I think that there is actually value to be had in a sort of common town square of code in that it encourages a lot of good sharing, and I think Github has done a great job at doing that. But the downside of the monoculture is that it can leave the technology stagnant. Most people that I know that use git just know five or six incantations to do the most common things and carrying that knowledge for another VCS just seems like more overhead to them.

In a lot of ways fossil is pretty stable and hasn't seen sweeping changes in a while. It hasn't really needed them, but I'm glad that it's getting some renewed interest
Man plans to launch himself in a homemade rocket to prove the Earth is flat
One thing I have been remarking recent conversations with other long-interested crypto-friends hasn't been about the price action, or about the drama, or about the lack of transparency on exchanges like Bitfinex -- but rather about the comparability of discussions today to those we were having in 2013. (Disclaimer: I attempt to avoid holding strong opinions in this space)

There are certainly patterns in the environment (maybe marketplace) which are repetitive and reminiscent of the early days. Confusion around price is one. Two viscerally opposed schools-of-thought is another.

One thing I think, though, that has suffered is the availability of information assessing the market structure or environment on it's merits/deficiencies without bias. This is likely hard to achieve, in general, but these days you cannot find reliable news without being sucked in to the swirl. Coindesk is pulling a CNBC-of-crypto, articles flying out every hour with opposing themes. I totally understand the model, captivating the audience, but it makes it hard to observe what's happening fundamentally (without having a grasp on the core narrative).

I continue to follow, in a casual way, but as I said continuously impressed by how the environment remains young -- trends from '13 persist to '17 and probably '18 (still young!).
And no wind tunnel can produce Mach 3 flows. Test pilots had to slowly expand the flight envelope of prototype aircraft.
You can disable Pocket. In about:config, toggle 'extensions.pocket.enabled' to false.
Senior Software Architect, ~7 years, $95k, Czech Republic
This fix doesn't seem to have made it into 4.14.1 unfortunately, and the Gentoo bug report came almost a week after this issue was identified and a patch posted to the bcache mailing list.
Tell them to pass a law that makes it illegal to set obvious passwords. That is negligent and it harms others.

It's illegal for a bus driver to get drunk and drive a bus full of people. Why is it not illegal for a sys admin to set 'password2017!' or a developer to set 'developer2017!' as the admin password on a website and increment the year when it's time for a change? I've seen first-hand (on multiple occasions) how bad passwords like these harm people on-line. It ought to be against the law.

If you do security basics right (patching, passwords and logging) you'll be fine 99% of the time. But people won't even do that (it's tedious and boring and not sophisticated). Instead, they obsess over APT's, zero-day exploits and nation state actors, when they really just need to start by patching and setting decent passwords.
I've always been curious how those sorts of internal conversations go at that level at companies that size. Anyone have any insights to share?
We detached this subthread from https://news.ycombinator.com/item?id=15748742 and marked it off-topic.
Ask HN: How do applications such as Paribus get customer-level data from Amazon?
I recently signed up for Paribus (paribus.co) and got my first money back on an online purchase. Woo, cool service. But then I started thinking about privacy: how does Paribus pull my list of ordered Amazon products?
Paribus asks to link with my gmail and Amazon account. Email alone is not sufficient because Amazon does not provide itemized email receipts. So Paribus asks me to sync my Amazon account, but my understanding is that Amazon does not have an API to provide customer order and product information (right?) They only have a Customer Profile API that returns customer email, zip code, etc. (right?)
Amazon does allow customers to download CVS of all orders with the needed information (https://www.amazon.com/gp/help/customer/display.html?nodeId=200131240) Is Paribus programmatically grabbing this data? Curious if anyone has hypotheses.
It looks like TLS 1.3 still puts server_name into ClientHello and that isn't encrypted.

I can't see how you could encrypt SNI without pushing TLS out to at least two round trips, which would suck for the Web although it might be tolerable in other applications.

One option that does occur to me would be to shove say, a 32-bit SHAKE(FQDN) instead of an FQDN in as the identifier. This way we don't show eavesdroppers the actual FQDN we wanted, although they can try to guess and discover if their guess was right at their leisure. So it doesn't prevent a sophisticated attacker verifying that we connected to vpn.example.com not www.example.com on the same IP address + port, but it does make it essentially impossible for them to find out that our server has a site named xy4298-beejee-hopskotch-914z.example.com by inspecting the traffic.

The server knows all the hosts it serves for, and can work out 32-bit SHAKE(name) for them and pick the right one or reject it without revealing anything extra. The birthday paradox means this is likely to have conflicts above a few tens of thousands of vhosts per server, but that's already getting into deeply bulk hosting territory where you don't care too much about security anyway. Ordinary people aren't doing much more than hundreds of distinct sites per IP address so conflicts for them would be extremely rare.
Surveymonkey a secure method to accept our privacy policy. DNA txt fle is uploaded to drop box securely. No personal health information is requested, and we don't accept any personal health information.
phenocopy.com is the name of the webpage.
located on sites.google.com/view/phenocopy.
The great thing about using Minio in front of Azure is that Minio supports pre-signed url generation whereas (as far as I know) Azure does not.
Either looking up to someone or holding them in contempt are very binary positions. People are complex. One can admire a person for the good they do and criticise and oppose them for the deliberate bad things they indulge in. I mean... none of us are purely black or white...
Before I left Square earlier this year, I lead our design efforts on the developer API.

https://docs.connect.squareup.com/

It was really interesting work and the team was quite committed once we found the right team.

People always asked what does a designer do on an API. It turns out that if the team cares, quite a lot.

Documentation is the obvious one but lots of other things like structuring the actual information, setting up apps, working on API explorers, look at terminology even how the endpoints are thought of and of course, how do you easiest get up and running with the API.

It was surprisingly interesting work from a design point of view.
Even if this was the correct way to handle such an incident, how can you be sure that once you've paid the hackers they actually destroy the data?
You're violating the guidelines by commenting like this. If you won't start posting civilly and substantively we'll ban the account. That means—especially on controversial topics—cleaving to the subject at hand and not fighting some secondary ideological battle.

https://news.ycombinator.com/newsguidelines.html
They can always call child services, and have DCFS pick up the kid. I think that is what one of the local daycares by me does, after a certain cutoff time (i.e., they can't be expected to stay open all night).
The author address this in the appendix:

> When I wrote this "ible" the original intent was to stick to Phillips look-a-likes. It grew to this.

> Due to input and interest shown by readers, I'm already working on a sequal, or re-write to include combo drives, security drives, and incorporate comments and new pictures.
We detached this subthread from https://news.ycombinator.com/item?id=15748742 and marked it off-topic. That's not precise, since it's not exactly off-topic, but the subthread went off into arguments about $400k and left the station.
More push-button. This can bootstrap an app with a fully-featured backend at once. Utilizing all AWS services of course.

They are probably feeling the heat from Firebase which is a much more robust offering than the hodgepodge of services you get from AWS and are trying to get some mindshare with mobile devs.
In addition to the programming/tech-oriented subreddits:

r/neutralpolitics
r/todayilearned
r/nottheonion
I don't know, paying off the hackers might have been the best call. It prevented my data from being exposed into the wild vs notifying authorities which would have all but guaranteed a leak. If the objective was to protect Ubers' customers, mission accomplished. Should they have covered it up and not disclosed it? No, but this is as a tough call ethically.
Is it wrong that, as a non-Bitfinex customer, I'm kind of rooting for an exit scam so that the price of BTC tanks and offers a perfect buying opportunity?
Honestly it sucks that these incredibly sketchy exchanges do so much volume. Poloniex and Bitfinex are sketchy as hell, but I guess their fees are low so no one cares.

It would be somewhat surprising if bitfinex doesn't go down in a spectacular ball of fire within the next 4 years.
So basically if I disclose a breach I lose my job because my company no longer exists?

Vs. Pretend I never saw any breach (how will you prove different?) and have a chance to avoid all penalties?
I have a large stack of paper with that story that I printed out. Excellent read for anyone with deserted island escapist fantasies. Also excellent because of the depth of his preparations and how he applies science and logic to his situation.

Can't recommend it enough.
The master of ceremonies was right, as in: acting disagreeable, pushy, socially superior, insulting, etc., and then directly propositioning someone for sex before paying for anything was effective in practice (at least twice) at getting women at a bar to agree to a one-night stand.

Edit: I read “the post”. Either the author has poor reading comprehension and largely failed to understand the content of the story (maybe Feynman can be blamed for not having written it in a clearer way), or she is being disingenuous.
Anything wage-related seems reliably to do that. I suppose it triggers both survival instincts and status issues.
Mobile Homes Are So Expensive Now, Hurricane Victims Can’t Afford Them
+1. The debate needs to be reframed. Right now we implicitly accept that corporations have a right to scrape and store our sensitive personal data with zero regard for security best practices, and we hem and haw over what the penalty should be, if any, when the leaks inevitably happen.

We need to look at it from the other direction. Leaking personal data harms consumers. If you do it and are shown to have been negligent, there should be a meaningful penalty. The legal/financial calculus needs to force corporations to take this stuff seriously, or not at all.

Corporation X does not have a right to exist in the future just because its business works in the present.
How is that malware? Just like when iPhones collected even more sensitive data (https://www.google.com/amp/s/amp.theguardian.com/technology/...), the data wasn't saved by the company logging the data. Xcodeghost is actual malware.
You should checkout pass

https://www.passwordstore.org/
Huh? This is pretty much exactly like Mt. Gox. At first Mt. Gox only suspended people's ability to withdraw USD, like Bitfinex. Then they suspended people's ability to withdraw BTC (apparently people have been experiencing delays getting crypto withdrawals to go through on BFX recently?). Even then they still allowed people to send money between accounts within the exchange, which resulted in a secondary market of people buying "Goxbux" from other people with money stuck in the exchange (at a discount, of course; basically betting that Mt. Gox was actually solvent).
I don't think it's a given that full permissions on a device imply that a user will be able to run their device the way they want to. Permissions are necessary but insufficient. The other part is knowledge and ability. With permission but not knowledge, the user experience gets worse not better.
Is your question if they exist?

https://www.indiehackers.com/podcast/034-mike-carson-of-park... claims 125k/month

Apart from the minecraft founder I'm most amazed by http://www.businessinsider.com/how-markus-frind-bootstrapped... For years he ran the website alone on a single (big) server, claimed working on it an hour or two per day and earning $10k/day in Adsense. http://www.workhappy.net/2009/01/remember-markus-frind-the-a...
I think it’s probably an exaggeration to say that ‘countless’ women were personally harassed by Lassiter personally, but countless women have been harassed by people like him and continue to be today.

I think people are focusing too much on individuals and missing a very important question: Why are we relying on journalists for this? Presumably all of these people work at corporations with HR departments. Why weren’t there consequences sooner?

Something is fundamentally broken with the incentives around harassment in the work place — HR departments exist to protect the company and its executives from lawsuits. They don’t exist to protect employees from the company. Until there are serious financial consequences for failing to act on harassment complaints sooner, nothing is going to change.

Every newspaper on earth can’t exclusively commit itself to uncover sexual harassment. Eventually this is going to die down— and then what? If Jane Engineer is harassed by Joe Manager today— where does she go? The media only cares about celebrities. Are HR departments changing their policies to stop the ongoing harassment today? I seriously suspect not.

In another ten years we’ll be seeing another round of these stories.
Usually the answers are the same. People feel empowered most often by the prevailing attitude of their societies. If we want to see less of something then we (all) need to speak up against it. Can we raise our hands when someone asks us if we ever went against prevailing culture and stood up for someone (or ourselves), even at a grave cost?

Also some are psychologically disturbed due to various reasons and those people need therapy and mere reactionary punishment will not improve matters in the long run (for society).
Have you pinpointed a specific problem that you have at interviews?
Sure, but why would they re-center the map for a logged-out device, even if they can tell it's overwhelmingly likely that it's the same user?
Lots of great photos in his slides.
Just so it's clear, moderators don't police threads that way; our concern is that people follow the site guidelines.

That comment was killed by software because the commenter was banned (more or less; it's a bit complicated) for having abused HN in the past.
Maidsafe is a new encrypted internet. Rent your disk space is sooo far from what it is
The problem isn't his media training, the problem is his moral compass. Treat your employees with respect just as you'd treat any human being with dignity.
Either end is fine.
>It's rare to hear someone say "I Googled it on Bing" //

True AFAIK but if you ever give computer support you'll find people "just google it" and use the greeting page on their browser [aka "the internet"] which is just as often Bing or Yahoo as it is Google. Google, the verb, is definitely generic but the RTM holders of Google have several hundred million of $currency to spend on lawyers to say it isn't.
Is there any independent evidence that they do in fact do so much volume? I know bitfinex in particular has been accused of creating fake wash trades in order to manipulate prices; this would also have the effect of increasing their reported trading volume.
Or maybe it's because people have valid concerns about little things like privacy, ethics, sexism, and the longer term effects of disruption that places more money and power into the hands of companies that are more than willing to overlook whatever regulations they deem are irrelevant.

Having those concerns isn't the same as unfailingly supporting incumbents, out of date regulation or a love of government.
> Of course it's right to hate people who have no respect for your

This crosses into political ranting which is definitely not what we want here. Thoughtful discussion, please, or nothing. We've had to warn you about this before.

https://news.ycombinator.com/newsguidelines.html
Well, day care operators have since learned...

... as I sit in my home office, just over an hour away from day care closing time I assure you I'm watching the clock like a hungry hawk watching a mouse. See, my kid's day care charges a mere $600 per hour late (billed in 1 minute increments).

I don't see kids parents late that often :-) and we've come close to missing it, but haven't in two years.
My MacBook Pro’s USB-C connectors glitch if you move them slightly. I like the data rate but I’m not happy with RAM-pack wobble in 2017.
What's your life like, to where you think not having a cell is practical? I've already argued that ditching a smartphone would be pretty inconvenient for me, but we'll put that aside. Society has changed in the last 15 years. Payphones are gone, no one plans quite as carefully in advance, people expect updates as soon as plans change, and to be able to choose between synchronous and asynchronous communication.
Might be a good time to link something wonderful about him (other than his physics; posted this previously on HN but it gained no traction)...

https://www.brainpickings.org/2017/10/17/richard-feynman-arl...
You can return structs just fine in C. The reason it's not generally done in practice is because C lacks return value optimization - the compiler (almost?) always has to do a hidden memcpy() at the end of your function due to pointer aliasing.
Do videos like this prove the earth is round:

https://www.youtube.com/watch?v=hQf4m6rew7c

https://www.youtube.com/watch?v=FHtvDA0W34I

There are comments saying that they use a fish-eye lense, but the only thing that seems to be affected is the earths curvature and nothing else...
> Do you people actually like having government pick winners and losers

Yes, many many people do.
That's probably why the price goes up.
Why would it be any less relevant today than it was when it was first posted? I doubt things have changed for him much in the last month...
WAP = https://en.wikipedia.org/wiki/Wireless_access_point

If you visit the US, you will find that most internet access sucks, but that public libraries are surprisingly decent. You won't be playing "Call of Duty: Kill Nazis 2017" on it, but it's perfectly decent for most uses.
Why would you respond like this to someone putting forward plain facts.
A web extension cannot read and write ordinary files on the file system. It cannot assign commands to the key combination Ctl-Shift-Q. It cannot redefine javascript objects created by the web page. These are not defaults that can be toggled by the user. They are hard coded into the design.