skysight-inc/HackerNews huggingface dataset:
Your comments about SAML are valid, but we're not implementing _all of SAML_. We're implementing the tiny subset that we can do safely once that you're actually going to use, once. This sidesteps some of the issues you're referring to. (Also: while I agree dsig is horrendous, I don't think that stops implementors: there's like 2-3 truly unique implementations, mostly libxmlsec1. People regularly write their own JWT but not dsig.)

If you reduce the scope from every-document-with-the-letters-SAML-on-it to just-the-SAML-you-need, I think the coinflip becomes much more obvious. OIDC is pretty hairy too, for example:

A) You may or may not get cryptographic binding. You can't tell from an intercepted interaction what security properties that interaction really has. For example: my understanding is that Google's OIDC implementation will bind to a specific client cred, so a leaked token sans leaked client cred isn't a big deal -- but that's something Google's implementation did, not something OIDC guarantees you, and it's not evident from the protcol flow. Do you have to validate that ID token signature? Turns out: no, because in practice everyone just does another leg and relies on TLS cert validation anyway, so this entire JWT dance was pointless. [0] This is one of my pet peeve regressions from OAuth1.0a to OAuth2.

B) Quick: what's the difference between state and nonce? Which one do I use and why? Empirically (but somewhat anecdotally) implementers don't understand this. (I know _why_ it happened, I just don't think it should've.)

... and of course C) JWT bugs in homegrown impls: very real.

You can sort-of reduce OIDC but you still end up with at least 3 distinct flows and then you might have a JWT'd ID token (so you may or may not have to do a third leg of extra work to actually get an identity assertion). OIDC is a meandering tree of options which does not fit in my head. TinySAML fits in my head. There's one obvious general flow and one tiny validation path. The only property you're not technically guaranteed is (cryptographic) audience restriction, but the IdP UX is in a unique position to de facto guarantee that (everyone gets their own key pair).

When you add to that SAML's crushing market penetration, I think it is the right call.

Finally, just to end with a slightly cheeky joke (please don't interpret this as the crux of my argument, I get that this is apples-to-oranges):

> cat **.go | wc -l
17060

> curl -s "https://openid.net/specs/openid-connect-core-1_0.html" | pandoc -t markdown | wc -l
12897

Keep in mind that the OIDC Core spec says things like "validate per OAuth2 RFC", so the real spec is much larger, but there's also a lot of HTML markdown that pandoc doesn't compress well.

[0]: https://developers.google.com/identity/protocols/OpenIDConne...
What I mean is that mathematical notation was never developed with the intention of being easily understood. Nobody writes out a formula and then spends time making it more readable. In programming they do - it's called refactoring. How mathematicians typically polish an already correct formula is called "simplification." This usually leads to their collection of symbols being even more inscrutable. But the more mathematical proofs, formulae, and other statements are unintelligible, the more they make you appear really smart, so the natural tendency is to obfuscate mathematical statements as much as possible. And because this notation cannot be executed by a machine, there is no way to easily prove that it isn't complete gibberish.
If you're going to go to all the trouble of writing (and debugging) bash scripts, why would you not just use Grunt to do the majority of it for you?

EDIT: (Asking this in the context of the grandparent comment suggesting getting rid of build systems in favour of NPM scripts)
Apparently a test flight of an Airbus 380 by the Emirates airline according to Spiegel Online: http://www.spiegel.de/reise/aktuell/emirates-testflug-ueber-...

So, yes, looks like somebody having a blast during Advent season. :-)
Daniel, please post more to HN.
CryptoZombies: Learn to Code Ethereum DApps by Building Your Own Game
I used to play with K long ago, it was tons of fun. Sometimes I think I should've been a quant and made crazy money :-)
No, they won't knock on your door with a tax bill. Because it's easier to tax you through inflation to finance that debt:

https://en.wikipedia.org/wiki/Seigniorage#Seigniorage_as_a_t...

"Economists regard seigniorage as a form of inflation tax, redistributing real resources to the currency issuer. Issuing new currency, rather than collecting taxes paid out of the existing money stock, is then considered in effect a tax that falls on those who hold the existing currency."
Books are not distraction machines in the sense phones are. Book may be a distraction from something else, but when you are already reading a book, you are concentrated, attention is stable and all cognitive faculties are being trained in positive direction (keeping the whole story in mind, imagining the plot etc.).
Phones, on the other hand, are distracting you while you are interacting with them. Attention is switching constantly between apps, even within a single app you may be constantly swiping through content in order to get gratification. In this mode you're UNLEARNING the stability of attention, that books help develop.
There may be specific apps and games that cultivate concentration as well, but the way the average kid uses their phone is definitively detrimental to their mental capabilities.
https://twitter.com/flightradar24/status/940959604896358400

> @Airbus is almost finished with their A380 Christmas tree. Will they put a star on top?
I live in Nevada. Nevada is 50th (or sometimes 49th) in the United States when they rank public education.

I grew up in Utah, and would NEVER had considered private school for my child there. My experience was fantastic.

But the difference in quality of education between these two states is so extreme, its hard to believe they are part of the same country and adhere to any of the same federal standards.
How Airlines Can Benefit from Big Data
Yup! It shows up by default, IIRC.

It's a layer on top of WebVR, similar to A-Frame.
As someone who doesn't look at flight radars often, I'm always surprised by how many planes are flying simultaneously.

Is there an estimation about how many more planes are possible before it gets too crowded?
Yeah... I just find the printed log output a bit easier to read (at least for the few times I need to do this sort of thing). '@' syntax falls into that same basic category - powerful, the better solution, but nothing I use enough to bother mastering.
The truth about migration: How it will reshape our world
Have you looked at an Argentina peso chart? Anything is better than that garbage. People who had dollar based accounts in Argentina lost 70% of their net worth overnight in 2002 when the government forcibly converted their accounts to pesos, so that doesn't work either.
Care to explain what this does? Thanks
>When did it made sense to parents to let their kids go to school with a tool known for its distraction impact ?

What makes you think parents are responsible? Most of the time they are even less responsible than their children.
While this seems legit, it's worth noting that ADSB, the RF message protocol used for most 'live' location stats in FlightRadar24, has no form of authentication. Nevermind the network protocol weaknesses, trolling FR24 would require little more than a $300 radio and some free software.
The biggest reason to switch to robots in manufacturing is quality control, followed by retooling speed, followed (distantly) by line speed. If you have any humans in your process, you only go as fast as they can.
The Anatomy of a Successful Digital Marketing Campaign
This is so exactly how I think...

When you're talking about complex abstract systems, I have 2 or 3 real world models going on in my head and playing out chains of consequences at the same time. When your abstract system falls down I can tell you where and what caused it despite not understanding a word of your explanation as to why it should. All those mathematical equations and models may as well be Greek to me.
Ouch, I should have explained that I was being sarcastic. Javagator was canceled in July 1998, so by 2000 it was thoroughly dead. Sun using Java no more makes it a major language than Google using Go does.

What I remember from the time was that C and C++ was everywhere, and Java was this weird new thing with a bunch of promises that ran slowly (because the JIT wasn't standard until later). There were a lot of people who were dismissive of Java, which was stupid, and there are a lot of people today who are dismissive of Go, which doesn't make sense to me either.
I agree that the math is more complicated but that doesn't mean you're being poorly compensated or anything. I'll charge as low as $80/hr for stuff like documentation prep. I also won't do documentation prep in 99% of instances because I'd rather charge $145/hr to write code.
Cool. Finally some free alternative to IDA decompiler plugin. IDA is still better due to interactive nature, i.e. you can explore the code and rename variables/functions as you keep on exploring. I hope this evolves into something like that.
This is a great piece.
https://market-ticker.org/akcs-www?post=232617
It's written by a disagreeable, cantankerous man, but he used to be the CEO of an ISP in Chicago years ago. He knows what he's talking about.
I can remember reading Bertel Schmitt over at TTAC [1] years ago. You will find very few people in the world who can write well enough and have the level of car industry knowledge that he has. If I remember correctly, he started working at Volkswagen in the 1980s.

I can still remember an article about a Toyota factory [2] that is quite the opposite from this Volvo factory

[1] http://www.thetruthaboutcars.com/author/bertel-schmitt
[2] http://archive.fortune.com/2011/02/18/news/international/toy...
Literate Data Analysis
It doesn't allow multiple concurrent writers easily - you have to handle the "SQLITE_BUSY" errors yourself and cope with any changes that might have happened in the interim (although transactions can obviously help.)

https://www.sqlite.org/lockingv3.html
For the same price, many people would rather have a newer house hooked into newer infrastructure and more space.
Curious to know what you did to rearrange your career.
That's why I used the fairly broad "has its origin in".
Google's own performance benchmark shows that Microsoft Edge is faster than Chrome and Firefox.[0]

[0] https://mybrowser.microsoft.com/en-US/features/performance
In this case, what most likely happens is that the first result is offered as the suggestion - i.e. the greyed-out part in the commandline. To accept that, press right-arrow (with the default bindings, of course).
Major airports and some routes between clusters of major airports, such as western Europe to the US east coast are already quite crowded with several at capacity.

Also, flight radar, especially at the zoomed out views, looks a lot more crowded than it really is, the airplane-icons are huge.
For one, both Tim and Pai are ignoring (or ignored in Tim's rase) public, rational arguments from consumers and consumer protection groups that conflicted with what Tim and Pai want to do.
Not only is Microsoft Edge faster, it's better for your battery life!
> I agree that this policy is a good one, but I don't think should be enforced by the school. I'm not an educator, but if I were I don't think I'd be happy about forfeiting my policy control to a government official.

Educators in public schools are government officials.

> How would a law like this even be enforced?

Laws and policies prohibiting objects in schools are common, and typically enforced through confiscation when the offending item is observed; whether after that the item is forefeited, returned to parents, or has some other disposition , and whether there is subsequently legal proceeding or additional penalty, varies considerably but is generally peripheral to primary enforcement.
LEDE has a very active anti-bufferbloat research people working with it.

LEDE has, in general, active, managed, and unified development. You'd have to hunt down a specific Tomato/DD version that works for you. Sometimes the latest version of DD/Tomato works, sometimes it doesn't. LEDE? Just download the latest stable release, done.
The Continuing Evolution of C++ – Bjarne Stroustrup – Strachey Lecture, Oxford
basically, a more specific routing address is used to direct packets through a specific route. In the earlier instance( the second example) Japan was the target. It is easy to see how the routing system in japan could have been crashed through such an overload (basically a ddos). Who would do that to Japan? China? Korea?

In the more recent instance, all the traffic from google, facebook, apple, and other major players was routed through russia. Is this china making russia look evil? after all, if the traffic is going through russia, all russia has to do is turn off the power for that router to momentarily stop all traffic.

or is this the NSA trying to #uck w russia and at the same time trying to create an incident so the fcc kills net neutrality to provide 'security'.

This is state of the art espionage
Monitoring /etc/hosts with osquery
Telegram desktop
The question is cost vs benefit.

I am a US citizen and I expect to cross the border exactly once if I leave. We are the evil empire and sure that has benefits, but no place else has used large scale Nuclear, Biological, and Chemical weapons which is probably why we assume others will.

We overthrow democracy's, assassinate leaders, torture, fund terrorists, and ignore the rule of law, but trust us we are the good guys just like those lovable Romans.
This is where Reader View is handy.
People don't move gold around. They trade gold IOU's which can be transferred faster than bitcoin, with far lower fees.
Visa card giveaway
Visa card giveaway

Evon Latrail is giving away visa gift cards to people who purchased her 2nd book, "Butterfly Me". For more info go to Facebook, Instagram, or Twitter and follow,
Evon Latrail

#antibullying #evonlatrail
Ycombinator.com alexa traffic statistics
What is the best way to prepare for a data science bootcamp?
Seeing Russia at 47% and Qatar at only 14% is very sad to see.
I work at Forza Football who made this survey, and during the survey we received app reviews like this one: "The application is perfect, too bad that ads to promote the LGBT movement appear "
Makes you very sad!
It's pretty standard landing page style these days for self-published books (plus ____), because it works.

If there was a way to tone it down for the referrals coming through Medium from HN (tough to track through 2 sites) or using some is-logged-in-to-HN hack (which would probably piss off people even more if detected) maybe it could be dialed back a hair to catch people like you, but it's probably not worth the effort.

The reply from the author seems to be perfect: https://news.ycombinator.com/item?id=15914307
South Korea Seeks Measures to Curb Bitcoin Frenzy
As an introverted person, spending more time alone as a child was the last thing I needed. There were a lot of social skills that I didn't develop until my mid-to-late twenties that would have saved me a lot of grief if I had been pushed into developing them earlier in life.
Because mathamaticians have thousands of years of history where they learned how to write math in a way that is readable to other mathamaticians.

Software engineering is a very different activity from the math that mathamaticians do. It makes sense that it has a different standard for what mathematicians do.

There are undoubtadly ways to improve mathematics, but it seems highly arrogant to say that your <100 year old field has discovered a massive improvement that mathematics has missed for centuries.
I seem to recall such a scenario playing out when the U.S. was trying to catch Snowden. Or was it Assange? I regret to admit it's all a bit of a nightmarish blur at this point.
Maybe demand wouldn't be impacted. Taxes affect every spending in the economy.

If you need to pay your taxes where that currency will come from? You are going to need to win it somehow.

Instead of exchange currencies in order to be able to pay taxes, why not accepting payment in the government currency in the first place?
Interesting project, if it meets the guidelines, this might make a good 'Show HN'. The Show HN guidelines are here, https://news.ycombinator.com/showhn.html
Bits 2.0 – Teach your kids the value of money and develop good habits
If you look around there are ways to reach them. The author of A Dark Room made a thorough post on this on Reddit but he’s since taken it down; maybe there’s an archive.
The syntax is really interesting, although the website is a bit confusing to navigate. Can in be transpiled to JavaScript beforehand, or is it meant to be used in an on the fly transpiler? I'm thinking in terms of minifying the source.
An ISP's job is to get data someone is sending me to me, and vice versa, their ISP's's job is to get data i am sending to them to them.

Why should I have to pay my ISP and theirs for the connection not to suck? They pay transit providers for us, and peer with other networks to facilitate that job. Now they want a bigger slice of the pie.
Shouldn't it be "an" xmas tree?
Colorized Math Equations
I imagine that those are hard to beat with machine learning precisely because they stump Google's own algorithms. By answering them, you're helping train their neural networks (which is why I rather resent having to answer them).
> no place else has used Nuclear, Biological, and Chemical weapons

Well, no other nation has used nuclear weapons in war, but several have used chemical and biological weapons.
The other thing that is misleading about this benchmark is that the comparison page shows results for many different DBs on vastly different hardware without any mention of price. It would be much more valuable if it attempted to normalize performance results by hardware cost.
The point about native is that it’s more likely to win over Apple/Google editorial teams for getting featured. And getting featured is an absolutely massive growth opportunity which you can optimize for.
The amendment repeatedly says "State", it isn't talking about the Federal government.

There's still due process to consider at the border, but applying border controls is pretty well established as due process.
Smooth Sailing with Kubernetes comic
I believe my parents said their parents told them same thing about TVs, and their parents parents told them radios, and so on.
Yeah, that was my own personal opinion prefacing the facts. Vue supports both, but the template system is generally used more in the Vue ecosystem than JSX is. Vue neatly fits between JSX and angular.js' clunky template language. Since the developer can quickly understand that Vue and React are both doing the same thing underneath, he can pick his preferred way to do it (template vs render func). I see in passing that more experienced devs I've worked with prefer the react way at a higher rate than those of less experience do. But mostly, you're right that v-directives are vastly more popular.
Sibilant Snakelikes
> You'd be amazed at the links politicians have with TV stations and newspapers.

As if it wasn't the case in any other country as well... US in particular...
If you watch on a clear night from the roof of my building in Manhattan, you can see about 3-4 planes at a time lined up to land at Newark. Sometimes it seems like the Berlin airlift because they just keep coming.
>ye olde php (and laravel) guy, where would one even start

Both PHP and JavaScript started as ill-conceived and/or rushed-up projects that due to (different) circumstances became hugely popular, and thus, the warts and faults started to be addressed and corrected little by little.

In this "correction" process, PHP 7 is much more farther away (more advanced, more mature) than the current state of Javascript, so i'd advise to stick to PHP 7; for the front-end, if you want to explore what you could do with heavy front-ends (i.e. Single page apps), try something like ClojureScript rather than straight JS.
I think it mostly works by inspecting your browser environment to see if it looks like a bot. I'm not really convinced that the pictures do much.
And sadly it seems the bots have improved even more then the CAPTCHA's. Googles latest variation of "Click on all boxes that contain X until none are shown" takes a significant amount of time to complete. It also seems that the faster you are in clicking the images the longer the next image takes to load, often leading to me hitting submit only to have to start all over again since the next image still contained what Google was looking for.

Sometimes I think it might be easier to just run a ML algorithm to complete them for me...
The model used in the post (LeNet) is very small compared to what we typically think of in terms of modern deep neural networks. The LeNet architecture itself was published in the 1990s and was designed for character recognition so this is a natural application of it. kNN would work for many characters in this example, but you would run into a problem with overlapping text. kNN on raw pixel intensities requires a nice segmentation of the ROI. More image processing/segmentation/morphological operations could be applied to help in that case, but given a small network architecture that will naturally learn these filters a tiny CNN works well with little preprocessing.
How many international wire transfers does a typical person make in their life?
And Television. And Radio. And tons of other things over the years. They aren't going away.
Creative Bundle for iPhone Users
Depends on if you intend it to be read as "Christmas" or "EX" mas. :)
Xmas is pronounced "Christmas" by most people.
I used to see similar on the approach to Heathrow when I was fly fishing at Syon Park in West London.
Yeah, this is the real reason. The pearl river delta has the densest industrial ecosystem in the world.

This is was a result of China's mercantilist trade policy - e.g. suppressing the value of the yuan/subsidizing industry

-> manufacturing moves to China

-> ecosystem gets richer

-> manufacturing becomes more valuable in China

-> more manufacturing moves there.

etc.

It took 20-30 years to get the ball rolling before network effects took over, but now if you want a specific kind of LED or a different size bolt at scale the chances are the pearl river delta will be the easiest place to source it and if that's what you want to build, it's the best place in the world to sell it.

The economic risk this presents to the rest of the world is severely underestimated. Industrial ecosystems take decades to grow and decades to decline, but access can be cut off overnight.
Show HN: Spectrum – Native iOS app for the colour blind
Sure, but unlike drugs or prostitution, aggressive police action doesn't harm any underprivileged classes, but rather a bunch of affluent tax evaders.
I mean, net neutrality is just a shitty duct tape solution to a bigger problem. If we treated ISPs as common carriers the way they do in the UK, we wouldn't need net neutrality.
The list of countries that have used both biological and chemical weapons at scale is surprisingly short.

PS: Russia has probably used a small scale nuclear weapon for assassination. https://en.wikipedia.org/wiki/Poisoning_of_Alexander_Litvine...