skysight-inc/HackerNews huggingface dataset:
> But please enlighten me. What kind of conversations could have possibly happened before this letter that could justify saying something like "You invested money (or time) and we've just lost all of it. You will be getting $0. But I need you to sign this so that other people CAN get some money. Oh by the way, it's a great news!"

This reminds me of when my father's employer went out in the wake of the 1999 bubble popping. A couple of years later, the CEO sent him a very nice email saying "hey, mind signing over your stock please" and he was about to do it. I thought it was fishy that the ex-CEO want something worthless back, so I called my uncle who invests in SMEs on the side of his job and he agreed that we should ask for something back in return.

So we asked, and got, a few thousand for his stock, without a whisper of complaint from the ex-CEO (guess we asked for too little).
Don't you have to run your own IMAP server for that to work?

Although my mail provider is fairly generous about storage space, it's not unlimited.
Smart Image Classification Library – SMIC
I assume you mean just “black swan”? I was curious about the white swan bit - maybe it was an orthogonal concept? But I settled on the regular kind.

https://en.m.wikipedia.org/wiki/Black_swan_theory
Train Deep Neural Networks for image classification. This tries to automate the process of hyperparameter tuning and returns a network that suits best for the task at hand.
Introducing Awesome Material Components
Here in Switzerland the fiber is owned by the regional utility company (power company for example). I think by law they have to allow every ISP to use it.

Now everyone (or almost everyone) in Switzerland can have fiber internet with gbit up and down.
While on the subject and since you're an expert in the field, there's something that's nagging me. How good are you guys at programming? My feeling is that most people in the infosec are average at best and only the elites are good at it.
Any gov't were lobby has more power then voters is by definition not a democracy.

> the laws change at the whim of the rulers.

There are not too many (probably non at all) places were law changes are voted on by the general public directly.

I really do not think that calling some place "undemocratic" helps. What is more interesting to me is to what extend a place rulers/rules promote or counter oppression.
This is a cool idea, but having the worker use http is just asking for problems. What happens if the http connection times out?
For a worker architecture, it can be expected for some jobs to take north of 5 minutes. Http will time out by then, but the worker will still keep on going.
If the username is used as the salt when storing the hashed password in the database, it's unpossible to know if a supplied password is valid-but-for-a-different-account.
This is a crucial question, especially anywhere that algorithms will be applied to areas where there are laws against discrimination.

If you want to use algorithms in these areas you will eventually have to prove that they don't illegally discriminate.
> we support every programming language that has networking features

If that's the case it should be highlighted in the docs, a short guide would help as well I guess. Just by quickly looking at the docs I assumed it's javascript only.

Having example bots in other popular languages would be perfect. People could focus on what's important and don't worry about integration details.
Why do arguments like this continue to be made, despite many cities already having municipal broadband?

This anti-governmental prejudice is tiring. Governments are made of people - what makes you trust those people less than other people?
"If support was provided by the vendor" is a big if...
Google was well aware of this inherent flaw but pushed NaCl regardless while at the same time promising for years that PNaCl would eventually solve all problems. PNaCl never really materialized, I think, and it feels like Google was throwing a smokescreen there to boost support and mindshare for NaCl.
The problem was not IE winning, the problem was it sleeping on the laurels after that. So when demands for what could be done on the web, for standards compliance increased IE become troublesome.
If there is a winning browser but it is still constantly developed and improved that would be less of a problem (though still not desirable).
I have an HP OfficeJet one which I guess is kinda "prosumer" (cant remember the number - 8600 or something). The ADF works, but is single-sided so that is why I am urging others to learn from my mistake :-)

I know that the cheapish Canon Maxify printers do duplex ADF (the Canon Maxify MB5150 is what I plan to buy next time my current HP one runs out of ink since the ink costs almost as much as the printer!), but I cant recommend it since I've not used it yet.

HTH.
Bitcoin plunges below $13,000, heads for worst week since 2013
Just fyi: http://www.writersdigest.com/editor-blogs/questions-and-quan...
xrb_183a7z5ohpfi7ixk5r4ayac4ms33xggkm69ihggbiin8tiq5zcp7w8a56r78

How do I mine some ?
Yup; The Division is err, a 3rd person shooter with a Diablo-style loot / gear system, along with online functionality like co-op missions and an optional pvp area.
Exactly. All that is required is that they lay the fiber and set up the cabinets, and let a regulated free market of ISPs do all the OSI layers above. It doesn’t have to be a government run ISP.

Even just laying conduit (layer 0?) would be an amazing public service.
We're used to assuming that the attacker knows a login and is guessing at a password, however the opposite scenario is is increasingly common.

Suppose another website has a security breach, revealing many names and passwords. User John Doe used a password of "foo", so an attacker starts trying combinations like jdoe/foo or johnd/foo or john_doe/foo, looking for the same person reusing a password on your site.

By denying them information about which login names exist, it's harder for the attacker to either zero-in on the correct username (and try alternate password variations) or to be certain that they've got nothing and that it's time to move on.
Mostly not:

https://en.wikipedia.org/wiki/East_Thrace

Then again, what is Europe, geographically? If I count continents, I count something often call "eurasia" as one continent, not two. I think cutting it in two over some mountain rig is a bit, well, arbitrary.
> It's not like the driver knows where the server is physically located.

Well, it probably currently doesn't guess the server location, but it doesn't seem impossible or even hard if they think it's useful to them.
a) that's survivorship bias - for every one who "worked" on those frameworks and got somewhere because of it, there are thousands who wasted their time. I would go as far as to say that those who worked on those frameworks and got hired would have been hired without that.

> If you have companies reaching out to you with potential job offers frequently, you can use that when negotiating salary when applying for a new job or to negotiate a raise at your current job

If you are one of those people who is a target of companies rather than recruiters outreach, then you do not care about frameworks. Hint: these are people who don't have interviews. They go for lunch. Or dinner.

> It's the same principle as the guy who interviewed at Google, Facebook, Airbnb & dozen other companies and then used several offers he got to negotiate and he ended up with ridiculously good package for software engineer.

That's an imaginary guy.
Might be making games. UE4 for example can eat up quite a lot of memory when doing things like building lighting and whatnot.
Mobile Gaming: Lightning-Fast and Powerful in the Cloud
You are a freelancer. This is a totally different market. Open source has very little to do with it, other than it is a part of your toolbox.
The accusation here is that they're maintaining the status quo, in a way, instead of working on making things better.
There's definitely a trend away from this to some degree lately, I feel. It's probably more influenced by Google not doing it with their accounts (enter username -> forwarded to password page with your avatar) more than anything else, mind.
The right answer isn't a blanket "sites should do this super-secret e-mail-only shuffle and not tell you anything".

First, you should define your threat model: which information is considered secret and which isn't, and treat any violations as security vulnerabilities.

If usernames are public by design, then don't hide them in one form, and expose in URLs elsewhere on the site.

If exposing who's registered on your site really is a threat, then by all means have a weird registration (and password reminder) that doesn't tell whether it worked or not. But if your site is for cookie receipies and you don't consider exposing who's a fan of cookies a privacy violation, then just use most helpful messages you can.
More like the EU has a huge anti-Belarus lobby (and for very good reasons). The Baltic countries mostly have their own nuclear plants, with no plans to close them; not that much anti-nuclear sentiment.
I could find user 'bo1024' has an account on pornhub - not necessarily you and you might not care but certain situations it may be a problem.

You could argue it's security through obscurity - I'd say preventing leaking data.
This kind of game is old. I remember I saw something very similar called "red code", about twenty years ago.
Thanks for the suggestions!

> it should be highlighted in the docs, a short guide would help as well I guess

I had the feeling these points were adressed already in [1]; are you thinking about something more prominent in the documentation ?

> having example bots in other popular languages would be perfect

You're right; we're definitely going to focus on this

[1] https://doc.bytearena.com/#getting-started-guides-getting-st...
Yes, basically that's what I said. That is, the USA MSM "under-reported" the lack of belief internationally. The American people were sold fiction and they gladly bought it.
Safari is the new IE. Chrome is the new IE. And then all these comment claiming IE6 was actually very good?

May be I am old. Old, at least by Silicon Valley standard. After all Webkit is the new IE was coined by someone who hasn't started programming in the IE 6 era and thought IE era meant IE7 onwards.

Do any of you remember what those days were? IE? Active X? Different code for different Browser? DHTML? That was before even the word Ajax was coined. Before we had Jquery?

The problem we had with IE6, for me at least wasn't really about its monopoly. It was about so many low hanging fruit that they could have improve, but decided not to, and it was at the start of the first Internet boom, we could have had a future much brighter, but Microsoft was using all sort of propriety tech and not working with standards, leading to Netscape and Mozilla having to engineering its "Quirk" mode. Developing for IE was simple enough, Developing for Netscape and IE was hell.

That was long time ago.

I guess Microsoft thought IE was good enough. Good for simple Documents with tables and little animation sprinkled on top. Given their very low quality of standards at the time, may be they really thought the Web was good enough.

Fast forward to today, I guess Apple thought the web, as basic web pages is good enough. At least we cant do better without breaking lots of compatibility. But then there are those who saw Internet as an App Platform, much like Java, write once run anywhere. And they see Apple as something that is stopping them to achieve that goal, much like how IE was stopping the Internet from becoming better.

It really is two different Goal, Web Pages or Web Apps. Some people thinks web pages is even done yet, CSS Grid is hardly the answer we were all looking for. Some think forget about Web pages, it is good for what it is, Web Apps. It is all we need.

For me? I just wanted simple and beautiful Web Pages, Stripe and Apple's Website is two example I like. So i do ignore people who think it is their right for Webassembly, WhateverDB, ServerWorker, PWA or what ever that NEEDS to be included in every Browser.

May be the younger ones thinks I am just old fart stopping them from reaching their goal. Just like I was thinking IE was stopping the Web becomes the Web. I guess, is just a matter of prospective, old vs the New, the age old question.
Interesting. Just reading this now, but it makes me wonder, what happens if you set two accounts to the same password?
Google is a big company, and there is a lot of variance between teams. I don't think this is a great generalization.

I have only worked in one small area, but my intuition is that if you end up doing something that's very much a part of the public face of the company (say, a flagship mobile app), your experience will probably be similar to other product-driven app companies, where there are people who specialize in making product decisions and people who specialize in implementation. Whereas if you're down in the bowels of the infrastructure for transforming protobufs into cat videos, you may never meet a product manager for your whole career.
I feel like intent is necessary for racial discrimination. To discriminate between racial discrimination and mere ignorance or ineptitude one must look at the intent.
This is actually a feature for users who have almost the same username and mistype this instead the password. E.g. this could probably happen through an unfamilar kayboard layout.

I understand that a lot of people think this is a security feature, but once upon a time it was the lazy programmers answer when "SELECT * FROM users WHERE username=? AND password=?" didn't return a result.

With proper salts for hashed passwords you now have to find the username, use the salt to hash the password and compare this. If your database allows to hash passwords with a dedicated function it's still the easiest to say username OR password must be wrong.
> I really do not think that calling some place "undemocratic" helps

Democracies are more stable and tend to contain healthier economies, in the long run [1]. Commerce doesn't care about "what extend [sic]...rulers/rules promote or counter oppression." It is meaningful, on the other hand, to consider how long a regime (and thus one's investments) will last, the odds of your employees being jailed for falling out of political favor, whether favorable rules (such as this one) could be re-written, again on someone's whim, et cetera.

[1] https://www.cambridge.org/core/journals/british-journal-of-p...
That's cheap though, a sattelite that size costs millions if not tens of millions.

Although I guess you could argue this one does too, given that it's not from the production line, probably hand-built.
More like, I log in as john with password 12345, but I forgot that I had to sign up as john87, so the password is correct and saying it isn't is misleading (even though the system doesn't know that for a fact, it is a possibility).
Strictly speaking, he said it in 2012, back when Erdoğan was just a dodgy Prime Minister. Of course, Putin was still around... What he meant was that he was the only dictator in Europe who was making no efforts to hide it; Russia and Turkey still have at least the pretence of free elections.
Security fundamentally is just "the art and science of how things work". Breaches in security are caused by malicious actors finding vulnerabilities in trusted systems, such as when Chinese webcams shipped with default credentials which made it trivial for the Mirai botnet to take them over and acquire so many devices that it could DDoS Dyn.

Towards that end, just about anything you learn can be applied in some way towards security. The conventional recommendations others have made will get your foot in the door, but ultimately security is a lifestyle of never-ending learning and imaginative reasoning about systems.

So to directly answer your questions, yes, there are links between data science and security (others have mentioned its use in things like malware research, but going the other way it's also important to store your data securely to prevent theft, destruction, or tampering) and you can learn something about information security pretty much anywhere in-depth information about computers is taught. Which information is relevant to your interests will just depend on which aspect of security is of interest to you.
The problem which the quote is pointing to here, is that then people use the old garbage to justify the new reprocessed garbage and vice versa, and it becomes harder for people to realise that it's garbage.
I used to use Notes but stopped after trying to back up my notes. For me, exporting one note at a time to pdf is not good enough, and finding the opaque binary file in ~/Library does not help because it is not a standard file format.

I switched to using Notes in Fastmail.
Very quick examples, if I can check if an email address is registered on a site I can

1. Identify people who are gay/bi (e.g. signed up to grindr)

2. Identify political affiliations (depending on site)

3. Identify health issues (signed up to a mental health forum, or cancer support group, etc)

These things people might be happy others knowing, but I hope you can at least see some cases where you might not.
Talking about [1] right (corewar) ?

I remember reading about it on HN a couple of monthes ago, and it was definitely an inspiration yes.

[1] http://vyznev.net/corewar/guide.html
Disclosing the existence of a user increases the success rate of certain attacks.

Say I've got a leaked password database for foo.com and know that the user bob@gmail.com uses the password "tomato1". If I try using his credentials to log into bar.com and get the message "username or password is incorrect", I'm just going to try the next user on the list. If I get the message "incorrect password", it makes sense for me to try "tomato2", "tomato3" etc. If I know that your password policy requires eight characters and a capital letter, I'm going to try "Tomato11". This is obviously trivial to automate.

You can't protect your users against credential-stuffing attacks if they use the same password everywhere, but you can offer them a small layer of protection if they use the same password with minor variations.

As others have pointed out, mere disclosure of the existence of an account could be a serious privacy breach in itself.
I am thankful for projects like OpenStreetMaps. If I ever switch to a libre mobile operating system it, will take little time to get OSM-based maps app there.

Main priority of giant corporations is money, no matter what. They will always support mainstream closed platforms only.
Seen this from the beginning of 2011. Raise the money, throw a dotcom-grade party at MGM Grand, spend like there is no tomorrow. No worries, the product and customers don’t matter much. Networking and hustling are everything this is all about. Rinse and repeat.

This is unhealthy and could not last for too long.
GitPlex – browse code in Git repository like in IDE
That looks very interesting. I'm OK with it only supporting recent AMD GPUs, but I hope the other changes will be upstreamed soon.
This is bad advice.

There's a reason that cyber is used, because you need something to disambiguate it from all the other kinds of security.

Imagine you're a policy person at the pentagon (or equivalent), if someone talks about security then that doesn't narrow it down to all the other kinds of security going on there.

You could use "info sec" but there are agencies who deal with a lot of information which doesn't necessarily mean this space either. They've been dealing with information security since their inception most of which I suspect is focused around people and not machines.

Cyber security makes it clear to those people what you're talking about.

To someone who works in SV and spends all day with developers the context is other way around, and in that context cyber sounds asinine and if you talk about security someone immediately knows it's security in your space.

That's my guess at why you tend to see 'info-sec' in the private space and 'cyber security' in the public space.
FinTech Prodegree by Barclays
The internet was practically invented by government institutions. Companies turned it into a mess.
Not done my homework with Rust yet. Pardon my ignorance.

Does Rust have a native(all Rust) implementation of SSH client yet?

(I know ssh2-rs exists, but, I'm looking for a Rust implementation and not a wrapper over libssh2(C))

Does Rust have a stable/documented library for serving Web applications over http/2 yet?

(I have heard about h2, hyper and Rocket, but can I write a basic web app in Rocket and expect it to use http/2?)

I like everything I hear about Rust. I will allocate serious learning time to it when the answers to the above questions turn to yes. Hopefully soon!!!
Wow, using the user as the salt is awesome. Is this considered an ok security practice?
“God of the gaps” yeah that’s pretty much what I thought!
You should check Genius Scan (for iOS and Android) that does that for you automatically, and much more: https://www.thegrizzlylabs.com/genius-scan/

It also doesn't tie you to a specific ecosystem.

Disclaimer: I'm on of the authors of Genius Scan :)
Alphabet is google and google IS evil.
I don't get why this was downwoted? By using google maps one contribute back traffic data and route problems for free + you share your position which can be sold to billboard advertisers for analysis...
I imagine all leaders share some traits no matter how good, evil, or truly monstrous they are. The reality is, however, that Americans can vote their leader out of office in a couple of years while in Belarus they just cannot.
The password may be correct for the user (who is a person, and has a password for that service).

Of course the person may have multiple user accounts and he may have given the "wrong" password for the "right" username account, but he may also have given the "right" password for the "wrong" username.
Why hasn’t the Year of the Linux Desktop happened yet?
Our ability to produce manufactured goods has very little to do with our ability to build infrastructure.

Construction productivity in the U.S. is actually DROPPING:

https://www.economist.com/blogs/graphicdetail/2017/08/daily-...

https://www.mckinsey.com/industries/capital-projects-and-inf...

http://harvardcgbc.org/wp-content/uploads/2016/11/Wang_2Page...
I wrote a collection of bash scripts for that. https://github.com/coaxial/insaned-config

It was initially to use with insaned, but I later came up with a script to tie it all together (scan.sh) because it's faster than jamming the scan button waiting for insaned to register. And with the script, I can queue commands provided I'm fast enough to swap the physical pages in the flatbed scanner.

It also uses the excellent textcleaner imagemagick script to clean up the scans and make them more ocr friendly.

The readme isn't totally up to date, parallel isn't required anymore, and there is no mention of the scan.sh script. But when you run it, it prompts for commands. You might need to edit the scripts to set your own output directories and textcleaner location.
Sounds like a great solution - would browsers need to support it? Do you have any resources on implementing it?
I'm just explaining what they did. They obviously could have continued to support C if they wanted. But if your waiting for C99 support your wait is in vain.

These days you can use clang so a nice C compiler has returned.
yeah, like gmail marking emails from people on the same business account as spam (for years) and account switching for google drive not working (for years) to name a few of my pet peeves.

Google does some great work, but their products are far from perfect, and many have been canned because they failed in the marketplace.