skysight-inc/HackerNews huggingface dataset:
Unpopular but very probably true fact: email can't practicably be made secure, and people should stop trying. Email is itself archaic, and there aren't good reasons people should use it for routine peer-to-peer communications that need secrecy.

Why? Because:

* It's default-plaintext. We don't generally love the way websites ensure they're viewed securely, but email doesn't even have the basic mechanisms HTTP has to prevent secrets from accidentally being sent in the clear.

* Email encryption is never forward-secure. The most popular standard, OpenPGP, involves a long-term key that is the root of secrecy for all messages from a particular person. Lose that key, ever, and not only is every message you send in the future unsafe, but every message you've ever sent in the past is too. That's a terrible property for a secure messaging system.

* Email leaks metadata. In fact, some of what we call email "metadata" isn't even metadata --- stuff like subject lines are simply content. They're sent in plaintext. We would never accept a new secure messaging system that behaved like that.

* Most email users get their email from a website. Unless you make them install something on all their computers --- and at that point, just get them to install Signal, WhatsApp, or Wire --- "encrypting" their email involves schemes in which those websites can get their plaintext mail.

* Most email clients are searchable-archive-by-default. Again, if you're using a secure messaging system to keep secrets from a state-level adversary, that's exactly what you don't want. And again, what matters here is the behavior of the overwhelming majority of clients. If you can stipulate a special mail client that is extra-careful, why not stipulate a forward-secure advanced messaging system and stop bothering with email?

Everything that makes email effective in the real world makes it inhospitable to secure messaging. We should stop trying to push this particular boulder up this particular mountain and instead just get people to adopt serious secure messengers.
Say your company needs a new vehicle with specific safety features while still being convenient. When you find the vehicle that meets the requirements do you just plop the manual on your managers desk and ask for an opinion?
>why should npm care

Name aside, the package as described is useless and serves no legitimate function.

If they're going to curate, they should do some quality control.
Here I was, thinking they might be using an abacus for some reason, only to discover they're talking about a case, not a computer.

Wooden cases have been used many times over the years. In fact my first computer back in 1978 had a wooden case: North Star Horizon. S100 bus, Z80, 16K RAM, 90K Floppy.

http://www.old-computers.com/history/images/Timeline_10-77_N...
> They acted in good faith.

They were aware of the problem for a couple of years:
https://twitter.com/TheSimha/status/949361495468642304
I don't the sense of the article is that PG FTS is better than ES , but in some situation, as the one I illustrated in my article, you can implement a the same search function with both of them, but with if have PG already in your stack configuring and using it with Django is very simple and convenient.
This is the second set. The repo also has the first set and solutions to both. These are creations out of my own answers at Stack Overflow and Code Review Stack Exchange. Feedback is welcome.
But isn't it enough to show that any point in the plane will eventually get tiled after 1 - 3 run for long enough?

Because surely all points do get tiled eventually by the method above.
Off topic:

I played PoE back in summer and autumn 2012, in closed beta, and I absolutely loved the game. I even spent some money on it :-) Then my gaming PC died. Nowadays I only play games on PS4. I just noticed that an Xbox1 version was released a few months back: are there any plans of ever bringing PoE to PS4? I would love to play it again, but can’t rationalise getting either a gaming PC or an Xbox to do so.
True, but this is easily detected. It’d have to provide tokens to the page, which would fail 100% of the time when sent to the Stripe API. These types of attacks are really only effective when difficult to detect, and therefore allowed to run for more than a very short time
>Curious, what would you rather do instead?

Moving away from SPAs seems like a dream at this point.
> this kind of attack is completely new.

Not really: http://www.daemonology.net/hyperthreading-considered-harmful...

That was in 2005. It might be an over-generalization, but one could say that Intel made that same mistake (at least) twice.
The email address format is so useful for domain-based identity.

We still haven't squared Zooko's Triangle. What is the practical way to get a function like "document was sent with best effort for some legal purpose to a known party"? Are we just stuck with "login to the secure messaging site" emails from our banks?
The stack I proposed in my article is pretty simple: Django + PostgreSQL (DB + FTS).

In other project I used Elastic for the search function: Django + PostgreSQL (DB) + Haystack + ES (FTS).

Is obvious that the second solution is more expensive.
You have a point, but we need to take into account that the technology has been around for a long time, the risks are well known and documented, and safety concerns of most of these package managers have been addressed to maintainers.

The example in the article has come to light accidentally, but we must seriously ask ourselves how many incidents are currently unidentified.

Besides, you can use Nix for 'normal' development. It is suitable for more things than just a distro package manager.
> Preclearance facilities exist because of agreements made between the U.S. federal government and the governments of the host countries. Travelers who have passed through the U.S. government checks, but whose flight or ship has not departed, remain in the legal jurisdiction of the host country.

https://en.wikipedia.org/wiki/United_States_border_precleara...
It’s misleading because rename is a command that accepts regex arguments. The shell isn’t doing anything more sophisticated with the quoted argument than passing it to rename as a positional parameter.

The shell of course does expand unquoted globs.
LSQ Software Engineer Ishita Mandhan: Find Your Community
But in many situation you don't need all the ES features and you can implement a quite good and fast FTS function directly with your PostgreSQL database if you already use it in your stack.
I am a happy CTO of a SaaS AI company but ever since I graduated a double Msc in computer science and EE, I miss playing with PLCs.

It seems to me that the worlds of industrial computing/EE and software are finally merging. Being involved in Navigator design & dev must be an amazing job.

Anyone has more technical info about it? I guess it's probably a bunch of QNX hosts sharing data on Modbus and from there bridges to the light show & al to synchronize everything?

Their careers section mentions Siemens gear but not much more...
Since it's incredibly unsafe to open document formats delivered over email in native viewers, we should be opening those documents on the web-based viewers on websites anyways. That's the most important advice we give at-risk users now: don't click.
Because the bible version isnt subject to copyright takedowns.
I recommend listing the exercices in the README file either by difficulty level or by subject (math, algorithm, io, ...)
That's really cool. I'd love to work on something like this.
> Lose that key, ever, and not only is every message you send in the future unsafe, but every message you've ever sent in the past is too. That's a terrible property for a secure messaging system.

That's false. There are mechanisms for lost keys revocation. This is already a solved problem.

> Email leaks metadata. In fact, some of what we call email "metadata" isn't even metadata --- stuff like subject lines are simply content. They're sent in plaintext. We would never accept a new secure messaging system that behaved like that.

So do you have any other email-like system out there, not dependent on a centralized service, that does not leak meta-data?

> * Most email users get their email from a website. Unless you make them install something on all their computers --- and at that point, just get them to install Signal, WhatsApp, or Wire --- "encrypting" their email involves schemes in which those websites can get their plaintext mail.

Can you host your own WhatsApp server? You own Signal server? No. Having your own email account on a VPS is trivial and much lower effort to remain in control of your communications.

The point is that you dont use website to consult your email if you want to move to encryption. And Email has a lot more benefits than your typical IM - it's a standard after all and can be used every everyone on Earth, you don't need to rely on any app adoption curve.
The lay public, aka everyone, isn't considered to be experts in this domain to address the issues. Hence, they disclosed to top tier OS distributions and partners.

It's similar to the Recalls of Takanas airbags in this regard. The manufacturers are informed and they tell us the consumer to bring in our cars. I'm not qualified to replace an explosive airbag, even though I drive a car daily as a lay person.
Looking at the graph: probably. It was already increasing (from 16-19%, one outlier to 27%, first 8 datapoints) to around 25-30% (the last 6 before the big jump). Then a big jump to 62-85% (N=20) with most around 75% (N≃13). The last bit is around 60-72% (N=12) and the very last datapoint is below 40% again but that is half outside the graph (cherry-picking datapoints?).

So to summarize, from 25% to 65%, or 2.6× the original.

Note that this is all from eyeballing that graph and estimating what percentage a datapoint is at, since the scale has an interval of 20 percent points and no minor grid or anything.
How is the ISS at all impressive? Low Earth Orbit, relative to the distance of the moon is a joke. LEO might as well be part of our atmosphere...
Thank you for your suggestion. I will do that.
Revocation doesn't provide forward security.

Standards are what we say they are; almost everyone can use Signal today, and we'd be better of spending the effort to make sure literally everybody can than trying to retrofit security onto SMTP email.
Conspiracy Theories: How I Became Fake News
Same for 2017.

I think a lot of it is down to the usage scenario, but the keyboard is the most obvious ‘flickerer’ I’ve seen... anywhere.

A screen like that [or a mandatory keyboard backlight] would be an instant dealbreaker to me.
It's really scary, say the wrong thing to a border agent and you can end up in prison, or banned from entry for life. I don't travel to the US often and unfortunately since 911, I am even less inclined to travel there due to the security measures imposed afterwards...does that mean the terrorists won?
Taxes, levies, excises, duties, substance schedules and a lot of other things are just implementations of political purposes/ideas.

Of course the difference between search for economic (tax evasion) control vs search for security (written/recorded "thought crime") control is the important difference here.
Does anyone here know why OpenCores atrophied so much between now and then? It had so much going for it.
Show HN: Nginx_proxy_zero, a no-nonsense Docker deployment api as a container
Just yesterday I installed Lubuntu 17.10 on an old Athlon XP computer. Firefox kept crashing, so I did a bit of research; turned out it was because the CPU doesn't support SSE2. Turns out most browsers these days require SSE2 (not that I blame them). The only modern-ish looking browser that's worked so far is NetSurf[0], but lots of sites have issues with it.

[0] http://www.netsurf-browser.org/
My CS book (Bryant and O'Hallaron, 2003, p. 399) says Control Data 6600 in 1964 was the first processor w out of order executuon, considered exotic until RS/6000 by IBM in 1990/PowerPC 601 in 1993.
What question?
I stand corrected, thanks for the info, hopefully I will never need use that info but nice to know still! +1
PG FTS support other languages https://www.postgresql.org/docs/current/static/textsearch-ps...
Anyway the point of my article is not that PG FST is better than ES, but that for a quite good and fast FTS function you can use only Django and PostgreSQL and most of the time you don't need all the other ES features and at the same time your stack will be easier to build and maintain.
RFC 7435: Opportunistic Security: Some Protection Most of the Time
> "The Perl erasure in this HN thread is startling."

"Erasure" to me implies some active effort to remove Perl from discourse. I don't see anything like that here: indeed, there are a number of positive mentions, and no negative ones I see. Granted, Python and Ruby are both mentioned more often, but none of those is at Perl's expense. Am I misunderstanding what you mean by 'erasure'?
> CPAN... forced you to be aware of what you're installing

I think CPAN is pretty sweet for variety/wide reach of packages available, but this is flat-out wrong.

CPAN is not a package manager; it is a file sprayer/script runner with a goal of dependency installation. That's perfectly sufficient for a lot of use cases, but to me "package manager" means "program that manages packages of software on my system", not the equivalent of "curl cpan.org/whatever | sh".

CPAN packages can (and do by very common convention) spray files all over the place on the target system. Then, those files are usually not tracked in a central place, so packages can't be uninstalled, packages that clobber other packages' files can't be detected, and "where did this file come from?"-type questions cannot be answered.

Whether CPAN or NPM "force you to be aware of what you're installing" seems like the least significant difference between the tools. When NPM tells you "I installed package 'foo'", it almost always means that the only changes it made to your system were in the "node_modules/foo" folder, global or not. When CPAN tells you "I installed package 'foo'" it means "I ran an install script that might have done anything that someone named 'foo'; hope that script gave you some verbose output and told you everything it was doing! Good luck removing/undoing its changes if you decide you don't want that package!"

There are ways around all of those issues with CPAN, and plenty of tools in Perl distribution utilities to address them, but they are far from universally taken advantage of. CPAN is extremely unlike, and often inferior to, NPM. Imagine if NPM packages did all of their installation logic inside a post-install hook; that's more like a CPAN distribution.
I had a stack of ~25 floppies that I used to download linux with X and some programs to run on a 486.

Software has gotten much bigger...
Other than the stupid name, this is a great debugger, completely replaced OllyDBG for me.
I’m impressed. Not one thing you just said is accurate.
Wouldn't the package need to be executed as root, though? Or does spectre/meltdown not require privileged access?
Were any of the deleted packages temporarily hijacked? It seems strongly like this was the case. If so, please confirm immediately so people who installed packages during this time can start scanning for malware.

Even if the answer is “yes, 1+ packages were hijacked by not-the-original author, but we’re still investigating if there was malware”, tell people immediately. Don’t wait a few days for your investigation and post mortem if it’s possible that some users’ systems have already been compromised.
It's 2018 and we're still talking about writing non-trivial bash scripts?
The Iris approach lowers the device’s battery life, and the screen’s contrast ratio.
I was expecting something else...

Let's be frank, affordable housing typically isn't expensive. Construction costs around the country and indeed the developed world aren't too far apart. In the US it's about $100-200 per square foot, in Western-Europe it's €1000-1500 per square metre.

The problem isn't really in construction, typically. Of course, there's always room for improvement everywhere, in construction too. But the big culprit are land prices. Take the Mission, they quote units costing $600k each, not affordable housing. But you're talking about a place where you need to pay $1.5m to just buy the piece of land on which you then build three small $100k units, for an average of $600k each.

Completely different story from the $100k unit in 'Portland', which was actually Gresham, east of Portland, where the average square foot price to buy land+home is <$200. Oh and the units were 375 square foot... $100k is expensive, if anything. The author completely ignores the market realities, again, mostly of expensive land prices.

And this creates the debate as to whether we should subsidise such housing. After all, if you put the same quality house in another city with cheaper land, you could build 4x as many homes, or twice as many that are twice as big or twice as luxurious. Why should we subsidise a fraction of our poor people to live in the most expensive place on the planet with public money that could go towards helping a larger fraction of people?

That's a though question to answer, I find... and I struggle with it, especially because I'm one of those guys who's in favour of these subsidies. Economic segregation is damaging in many ways, plenty of sociological studies have shown. It's important to keep our cities accessible to everyone and create a healthy mix of people from all socioeconomic backgrounds, as opposed to rich enclaves and poor ghettos. But, finding the balance is hard. I don't live in the US but we have similar problems here in Western-Europe with subsidised housing, at the end of the day it's an issue of land prices skyrocketing, it doesn't have as much to do with construction costs as we tend to think. And it's really hard to find the right balance of using public money to buy expensive land for a small group of people.
I think this might help others, but ShellCheck[0] is a good place to start to help eliminate poor shell scripting.

And I would make an argument though that even large shell scripts in bash have their place.

I often write scripts in either Node or Python, but only when I need things bash is bad about (any sort of proper data structure beyond strings or arrays).

But there are just so many things bash makes insanely easy, especially with operating on files and directories.

And functions that are used as completions or need access to aliases or functions in the current process are also better in bash.

I wish there were a scripting language like bash, but enhanced with at least some hash maps and proper array manipulation, and maybe some formal IPC to allow scripts to request info from the parent process.
You've got two mistakes here. First, the sun appearing to move a diameter in two minutes is due to the rotation of the Earth, not the relative motion of the Earth to the sun (that's obviously a year). This can happen even if the sun and the Earth are fixed in space (with the Earth still rotating about its center). So this certainly does not make the sun look like it is in the 'wrong' spot.

Secondly, even the motion of the Earth in its orbit around the sun does not cause an 8 minute delay in the apparent location of the sun. The location the sun appears is determined by the direction that its light rays are travelling when they hit Earth. Even with the Earth travelling through space, the light rays that it hits at every point are always pointing back to the exact physical center of the sun as if there Earth were not moving. Yes, those light rays left 8 minutes ago from the sun, but the ones that Earth hits now are the ones that were heading towards Earth's current position, not the ones heading to Earth's position 8 minutes ago. Hence they are pointed from the sun to the Earth's current position.

If you can't visualize this, then imagine a alien sitting in its space ship hovering fixed in space (relative to the sun) just next to Earth's orbit as Earth passes by. Both you and the alien shoot a bullet such that its velocity is going exactly back along a light ray from the sun. Clearly the aliens' bullet will reach the sun. But then so too must your bullet: both you and the alien matched the same ray of light so your bullets are actually travelling in exactly the same direction from the same starting point. So in that sense the ray of light that you see is pointed right at where the sun is right then.
I'd be interested to know what TomsRtBt is like on that machine.
You are describing bad development practices.

Not sure why you’re stuck on the number of deps either - as long as they’re small who cares?
Give /r/NeutralPolitics a shot.

It's a heavily moderated subreddit focusing on well sourced content.

Essentially, if a comment(fact) doesn't have a respected source attached it gets booted.
Themed TK uses native widgets and it presents the same basic API. It's distributed by default too, it's not an external library. You can use both the old and the new widgets in the same GUI.

For simple GUIs it's easy to use and the code is clean and extendable. There is a canvas object for arbitrary graphics or custom widgets, but without OpenGL support they look ugly and it's not performant.
The existing widgets are the basic, so no high-level stuff like date-pickers.

As for the layout "language", there are 3 layout managers that CSS has only begun to reach feature parity:
- "pack" which is like flexbox
- "grid" which is like CSS Grid
- "place" which is like absolutely positioned elements
All this can be mixed and matched.

With a couple hundred lines of Python you can do a React-like and bind tightly the entire GUI state to a complex `dict` that can be serialized to JSON in a couple of lines. Don't discount Tk just yet.
>In the US it's about $100-200 per square foot, in Western-Europe it's €1000-1500 per square metre.

quick conversion, because i had to google it: there's ~10.5sqft in a square metre, so those costs are roughly equal.
Start posting large parts of, say, the New International Version, let me know how that goes for you.

IOW, unless it’s the King James, it is likely very much subject to take down notices. Though I’m guessing a malicious troll is much more likely to know The Byrds than they are Old Testament.
No JS framework does that because they version things. Run the same versions and it works.

If you’re not pinning versions correctly that’s hardly JS’s fault.
Next-gen flexible robots move and heal like us
If your "document" is based also on columns on other table, as in the example on my article, you can't have a GIN index on your expression, but you can have a GIN index on your specified column.
The Maven Central repository for JVM dependencies doesn't share the problem of packages being removed like NPM periodically has, but Adam Bien has been instructing users to download the source-code for their dependencies and then compile them to their own repositories for quite a few years.

I wish I'd taken his advice as there are a couple of JAR files that I can no longer update.
I really wish that people would stop referencing that "Fractal of Bad Design" article. It's outdated and mostly irrelevant now (April 2012, PHP was at 5.4 then, it's at 7.2 now). It's not that I want to defend PHP, I just think people should judge PHP for what it is now instead of what it was several major changes ago.

Besides, the author seems to misunderstand a great many things about PHP and languages in general. Here's a short rebuttal (also from April 2012): https://blog.ircmaxell.com/2012/04/php-sucks-but-i-like-it.h... that explains some of the misunderstandings.
Something I always find interesting is the word Eco-Nomics which is a greek and latin mashup for "study of the home", but still the Eco prefix seems to have a similar meaning here.
I believe an LPR could be paroled, pending a hearing with an immigration judge.

Saying that, the only people who cannot be denied entry to the US are indeed USC.