skysight-inc/HackerNews huggingface dataset:
> * Media query - So what, user agent gives this away mostly anyways

It doesn't; without media queries you can't detect thing like browser window size or screen pixel density.

> * Font checking - Can help fingerprinting...browsers need to start restricting this list better IMO (not familiar w/ current tech, but would hope we could get it down to OS-specific at the most)

There's a lot of trade-offs here. Plenty of people have fonts installed for various reasons (some because none of the system fonts cover a script they want, some because they're using fonts designed to mitigate some issues caused by dyslexia, etc.), and breaking it for those people would not be good.
A discussion two weeks ago pointed out that much of the hate Atlassian endures from developers towards their JIRA product is employer-inflicted:

>nunez: JIRA is a really nice product, but one's experience with it heavily depends on who "owns" it

>wwalser: the hellish existence [...] where JIRA comes up [is] because of one of three things:

· Your admin(s) set it up once and hasn't bothered to iterate on those workflows

· The business mapped their autonomy stripping processes onto JIRA intentionally [...]

· You're on an instance that is serving too many people with too few resources

source: How Atlassian Built a $10B Growth Engine | https://news.ycombinator.com/item?id=16052743 (2018Jan:226 points,170 comments)
Interesting trick. But I think adBlockers block requests to entire tracking domains. So even css calls would be blocked?
At my company https://voicefox.com, our bot attends a meeting on Google Meet, GoToMeeting and others. We connect to them meeting using Linux-based Chrome and capture the recording server side. From our experience so far, Google Meet (new hangouts version) has the best quality of video
Permanent revolution! Great way to build a stable society.
It has first mover advantage and a brand name. That's literally all the distinguishes it from clone coins.

There being a set amount is only relevant in that context.
I'd disagree on the first point, but only because it seems that many launch systems use floppy drives. (The big ones)
> since the main advantage of WP is that it's FOSS

Maybe, maybe not anymore. Now the main advantage of WP is that it's ubiquitous/low barrier to entry and has (too) many plugins/themes/etc available.

Incidentally, that's also WP's main disadvantage because those things greatly increase it's attach surface.
I particularly liked the comment (apologies for the caps) "BAD DESIGN" ad nauseum :)
Sadly, it still has no OMEMO support (yet):

https://omemo.top
Goodbye, shitty Car extends Vehicle object-orientation tutorial (2011)
> Property obliges. Its use should also serve the public good.

Honestly, when I got this translation it was so absurd that I was completely sure that I miss something here. What does "property" oblige you to? How can state's constitution dictate to what end property can be used?

If I would be living in a country with such a constitution, I would either try to change it, move somewhere else or just consider myself not morally bound by the country's laws as completely immoral.

> That's kinda like saying cars should only go fast, if you also want to not die when taking a breath outside, you have to wear a gas mask or deploy nanobots that remove pollutants from the atmosphere.

I think that for a productive discussion, we need to separate two things: main goal and side conditions. You have a good point that any paperclip optimizer should have necessary side conditions, like "not destroy the world while you're at it". However, in it's decision making process these conditions should be very different from the main goal: they should be simple boolean categories, just something that you have to maintain at all times, not a numeric parameter that you can increase indefinetly - this should be goal.

Thankfully, companies already have boolean conditions like that, they're called laws.
I have high hopes for Istio, looking forward to using it in 2018!
Peter Madsen charged with 'submarine murder' of Kim Wall
A bit on the snarky side I realize, but someone at Facebook has probably already dug into this. Whether or not they'll admit it or discuss it publicly is far less likely.
I agree, having been to Cuba many times and seen the atmosphere there towards Canadians, and knowing Canadians who have done business there and been courted to do business by the Cuban gov't, etc. I can't see this being something the Castro regime would initiate or even tolerate. It works against their own interests big time.

So I don't even see any motivation for the Cubans to have instigated an attack at all and myy best guess would be something done by North Korea or Russia or some other actor that has been a soft ally of Cuba, but also benefits from ongoing conflict between the US and Cuba, and would also benefit from worsening relations between Canada and Cuba.

That the US hasn't initiated stronger retaliation makes me think they know this to.
AWS has their own v4 signature method that I always thought was neat.

Key benefits:

* Secret not included in request

* Verifies integrity of the message (since its contents are signed)

* Protection against replay attacks

It's probably overkill in a lot of situations, but I've always liked how even if TLS were compromised, all the attacker would gain is the ability to see the requests--not modify them or forge new ones.

I haven't used JWT before, but reading one of the links below, it looks like it covers a lot of the same stuff (although you'd have to implement your own replay protection if you want that).
>Besides half of Europe wanted to be socialist -- and I'm speaking of the support for such parties in Western Europe.

There's a big, big difference between wanting to be socialist and living under a Soviet regime.

It is US business because if Europe was overrun by Soviets, the US would have to get involved, if not for their own interests, certainly the interests of the now subjugated Europe. It's also a hell of a lot harder fighting with your back to the ocean. I mean we are talking the exact same scenario that happened in 1914 and 1939, except instead of Germany, it would have been the USSR. The Eastern Bloc countries revolted for a reason.

Not only that, the victors of WWII wanted the US military there for that very reason.

>Again, not the business of a foreign power to meddle.

It sure was welcomed in 1917 and 1941.
>In the mean time you can ponder if you need to announce a tsunami.

I would suggest that recent history [1] has shown we can have a 30m-2h warning, and that isn't good enough.

[1] https://en.wikipedia.org/wiki/2004_Indian_Ocean_earthquake_a...
Haha! It was that announcement which gave me the idea to post this now in the first place. Thanks, and we agree about the proprietary bit - hopefully we as a community will have the tools to handle raw machines easily and conveniently (I think that's the biggest selling point of GC & AWS), because the amount of money wasted on GC and AWS is just insane.
I like the idea that the Internet forgets things. Seems healthy. Eternal memory for some things is disturbing.
The thing that annoys me most about this situation is people complaining about how long it took to send out the "Sorry, there was no missile" message. Just as I expected these were hard-coded messages that were sent out by a button (link) click and not a free-form text area. There are many (good) reasons you want your program set up this way (let's ignore the rest of the terrible UI/UX for now).

It makes complete sense to me that given a spec of "make a button send this specific text" you would end up with this. So it's very easy to send the initial message but sending a custom follow up requires contacting someone with access to the underlying system who can send a custom message.

In the same way that I may give internal users the ability to fire off SPECIFIC (maybe with placeholders) push notifications with the press of a button but not custom messages. Sure my underlying infrastructure can handle custom messages but the UI for such a feature does not exist (or at least is not available to the person who might have the ability to send preset messages).

All in all this was terrible for the people in Hawaii, no doubt. That said I WANT my missile alert system to be easy to activate to give people the most time I can to prepare. The best fix for this (yes a new UI/UX would be best but let's be realistic on how much time/energy they are willing to spend on this) would be a scary looking alert confirmation dialog of "Are you sure you want to send this alert to the whole state?" and maybe have to type a confirmation string.
Debt jubilees, old testament's version of bankruptcy, could save capitalism.
The full course title being MIT 6.S094 Deep Learning for Self-Driving Cars.
I've turned down a very interesting job because they wanted me to work 5 days a week. I had a kid (now I have two), so I wanted to work a maximum of 4 days a week.

It's sad. It sounded really interesting, and they were very understanding, and yet, for whatever reason, they wouldn't budge.
> A violinist might be asked to play a technically difficult but short piece during an audition,

No. Compared to what we do as software developers, the correct analogy for a violinist interview would be to ask them to whiteboard all kinds of obscure music theory principles, like the set theory underlying serialism and Arnold Schoenberg's twelve-tone technique.
Top 10+ ICO Listing Sites
In the case of reddit, the custom CSS could not reference off-reddit resources (images were uploaded), so this technique would not work.
Seth, an Ethereum army knife for the command line
It'd be nice to have a nice big divider between "live" and "test" messages, and different colors for the two. Small tweaks would go a long way here.
Screen readers interface with normal browsers, so JS and CSS will be loaded as per usual (unless the user has gone to the trouble of turning them off).
> It doesn't; without media queries you can't detect thing like browser window size or screen pixel density.

Sorry if I wasn't clear. I shouldn't have said media queries, I should have said "CSS property queries". What CSS properties you have doesn't leak any more than your UA I would guess.

> There's a lot of trade-offs here [...]

I'll take it as an option to have a strict subset (though would prefer it as opt-out to discourage font-list-based fingerprinting as a practice, though metric-based may never leave). With downloadable fonts, I don't really like the "script they want" excuse. For accessibility reasons, I am admittedly naive, but I would assume it would be a substitute for an existing font name. Unique font names per user seem unnecessary.
I use a very simple setup of HTML + template engine (Jinja2). Then I maintain the entries of my resume in a YAML file. Finally, I export HTML to pdf.

If interested, I describe it here: bernhardwenzel.com/articles/jinja-yaml/ + github
> I've seen it in practice how a friend tried to learn programming with his US ANSI keyboard, by copy-pasting those characters when needed.

Couldn't your friend use trigraphs (https://en.wikipedia.org/wiki/Digraphs_and_trigraphs) in place of these characters?
It appears in this case, Uber has designed a system with exactly that result: the police do not punish the local staff for the remote lockdown, and cannot punish the overseas sysadmins who caused it.
> eggshell skull doctrine would rather be used to exculpate Tyler

This is the opposite of how the doctrine works.

https://en.wikipedia.org/wiki/Eggshell_skull

"the unexpected frailty of the injured person is not a valid defense to the seriousness of any injury caused to them."

Paraphrasing, the doctrine says that if you do something dangerous, and it does far more damage than you expected, you are culpable for the full extent of damage and not just the damage you thought was likely.

Other related concepts are "you take your victim as they are" and "depraved indifference" murder (https://en.wikipedia.org/wiki/Depraved-heart_murder).

As roel_v suggests, it is odd how far the hyper-rationalist conception of guilt differs from the law's conception. If you set into motion events with predictable risk of serious harm be prepared to be held responsible for whatever happens even if you get unlucky and "serious" escalates to "catastrophic".
More readable non-mobile link: http://www.scmp.com/news/china/society/article/2128355/china...
I'm cringing so hard at the idea of a tech guy somewhere explaining to his boss that "we can't go serverless because we don't have enough servers for that". You know that conversation is happening in an office somewhere.

Godspeed, poor engineer.
Cr3dOv3r v0.3 – Know the Dangers of Credential Reuse Attacks
This didn't fix the compilation errors for me. I can set my own no_mangle pub extern `_Unwind_Resume` function (without declaring it a lang_item) and fix the undefined reference that way, but I'm pretty sure that's not how one's supposed to solve this
Sketch Design System 1.0
Why can't you switch to US layout when coding and switch back to Estonian when writing Estonian text?
Next.js to adopt React Router
I completely agree on your second point, obviously in the long run everything has to be for the company, but hands on the team is number 1. Particularly in larger organisations the only way to manage is to focus on your team and its sphere on influence because often there is no "best for the company". The best thing you can do is build a great productive team.
https://news.ycombinator.com/item?id=16152050
luck favors prepared.
Small niche product. I wish I could focus to come up with one to put time into. Why? Full control and ability to hit a goal of side income type of profit. If it goes well enough then it becomes a "lifestyle" business I would work on, ideally having a work/life imbalance that favors the life side more.

Working for a startup means you are working for someone else essentially. Unless you have a serious percentage of options.
The scary thing to me is this system probably has full permissions on my phone. =(
Or maybe not anarchy, but a result of committed increasingly politically conscious young people trying to stop an unjust, brutal, imperialist war, and in the process learning just how ugly their brutal imperialist government(s) were. And getting push back from that regime with force and oppression. And as a result some taking it to the logical extreme.
Sweden is seen as a democratic-socialist country, but the guns were definitely aimed east. This was probably the case for most countries in Europe. Why would anyone want to be part of the Soviet union? Not even the Soviet members did.

I think the "foreign power meddling in our business" needs to be nuanced -- I'm personally happy the US decided to spend taxpayer's money to keep us safe.
Depends on what you want. You can just use an API key if it's for easy access, through a header.

If you want more, then use username + pass. Encrypt both or generate something from both of them. Eg. encrypt(username):encrypt(pass)

If you want more, use private & public keys, which receive a session token the first time ( when authenticating).

...

I think the end result would be a self hosted oauth server with permission management.
Yet another paper discovers the obvious. The "cure" for the plague was 40 days off isolation of affected homes or cities. Rats and fleas don't respect human quarantines.

Another factor is rats. They are killed by plague just like humans. At least one person should have noted large volumes of rats dropping dead everywhere, but that isn't mentioned in writings of the time.
Would this be, you know, by any chance, a Perl or PHP CGI bin triggered by an intranet link?
How much do you think the government contractor(s) who built this got paid? My, and possible your, tax dollars at work...
'I always browse the Web with CSS disabled'!!!!111oneoneone /s (is this how it works??)

Doesn't everyone?? ;)
Six Questions to Ask Your Software Consultant Team
OAuth 2.0 is so bloated that it scares people off. Something like the client credentials flow is relatively easy to implement on your own and is basically lets clients exchange a client_id (username) and secret (password) for an API key.

Bonus: If you stay close enough to the standard you can plugin a real OAuth 2.0 provider if/when you decide you need it.
Doesn't a session token violate the stateless principle ?
This is extremely widely misunderstood, one of those rampant FUD topics.

Archive nodes in Ethereum are almost completely superfluous.

An Ethereum archive node is not the same thing as a full node.

Archive nodes add zero extra security to the network. They are only useful for historical analysis of past states.

100% of the blockchain information is stored in non-archival full nodes.

The Ethereum system is a series of transactions that modify a state. The system is completely defined by the transactions. The latest state can be derived from them.

An archive node is a node that stores all past states for efficient retrieval.
Human Factors is becoming more well known, especially in health care.

This screen is scary. Now imagine drugs used during surgery that look almost identical.

Here are some exampels:

https://twitter.com/EzDrugID/status/933871776152543233

https://twitter.com/EzDrugID/status/850259195618131968

It's frustrating that we know this is a source of human error and that we're still doing it.
Downside is that this is very new and there is only a PHP library.
Relevant Far Side comic: https://i.imgur.com/AosYvGn.jpg
It's not a storage problem, right now at block 530,000 BTC, and ethereum at block 4,900,00 its pretty much a so what about size, btc is about 200gb and eth is about 100gb

SIZE of the storage on the block is not the problem, the problem IMHO is that the 'go' implementation of ETH doesn't truth other clients,

BTC is wild-wild west where its fairly fast to 'sync', maybe 4 days at 50 MB/sec, and your synced at the current block for mining, but on ETH you can run a full-node for weeks if not months and never 'sync', I have full-nodes that I started weeks ago with --fast, and they still have NEVER caught up with the current node,

NOW IMHO here's the deal, the reason that they don't catch up, is that in ETH some nodes are more equal than others, some nodes have 4 legs, some have 2 legs ( animal farm ) this all goes back to BUTERIN who believes that only trusted animals can have the current block-chain, the others simply play 'catch-up'

To give an example I have full-nodes running on --fast mode that are finding new blocks slower than they're being mined, which means that that the longer I run the full node the more I fall behind. Now a good mother might ask?? WHy would this be? AGain, its a matter of 'trust'

ETH is largely about paranoia, and BTC is largely about trusting the unknown; BTC is working ETH is not,

I think because ETH is ran by a child "BUTERIN" and nobody has the guts to call him on his stupid view of the world ( mainly because he still thinks like a 14 year old computer genius )

BUTERIN, like so many of his ilk, never worked in industry, never bothered to understand 'scaling' or real problems of the real world, and certainly never bought into the view of NSA ( SATOSHI ) that BTC was supposed to be by 'consensus', one of the things if you follow ETH you will learn quickly is ETH is a NANNY and BUTERIN is the mother.

In summary ETH has failed because it is 180 opposed to the anarchy of Nakamota-SAtoshi(NSA), there is nothing libertarian about ETH, its just a classic example of investors putting blind trust in a child and I saw this many times when I was young, older people with no technical knowledge following conmen.
“No one is bombing Hawaii”
wtf. I hope Trump nuclear bottom is really bigger than that.
>maybe have to type a confirmation string

Having to type out YES or some phrase is a fairly common "Are you really sure you want to do this??" sort of thing. I gather they're also looking at requiring a second person's confirmation which, if practical and very unlikely to make it impossible to send any message, seems reasonable as well.
1st Pillar (Pt 3): How an Improved Patient Satisfaction Impacts Your Bottom Line
Please stop being confidently wrong about this.
Taking and repaying a loan not only helps in solving the problem that the loan was earmarked for, but it also demonstrates the responsibility of the recipient government.

Making it a loan will also allow for larger sums to be spent.

Japan's ODA has been mainly done in Asia, and to me it looks like its philosophy is producing results.
An ICBM will land about 30 minutes after it launches. At those kinds of timescales, every delay you put in somebody's path to issue the warning, even a few seconds, is going to be a cost measured in lives.

How many people are you willing to kill to reduce the risk of a false alarm?
This is the part that both amazed and confuses me about Nintendo.

They refuse to do proper sales on the Switch hardware, and yet all they have to do is have a decently discounted sale and if they sell 1 game per console they're already back in the black.

All their profit comes from the games, whereas the choice of buying a console for the consumer is high% the price of the console and only low% the price of games.
Indeed, that would be enough to stop the dynamic tracking - no need to go full no-CSS.
My experience of react router was constant breaking changes including radical redesigns that require complete application rearchitecture without any help or documentation from the react router project. GitHub comment threads will show that this is what others experienced too.
...would be a scary looking alert confirmation dialog

If I had a bitcoin for every time someone clicked through the confirm dialog without looking...
Wow, CSS is the new JS :D
Indeed, I have vivid memories of reading the chapter in Unix Power Tools devoted to this very topic: https://docstore.mik.ua/orelly/unix2.1/upt/ch47_01.htm
I couldn’t help but think of the book “The Water Knife”. In the book it is the the Chinese that build massive liveable spaces that recycle the water and purify the air. Just a small step in that direction.
Nice idea, I hope it succeeds! However I would never move my critical WP stuff to a new unknown hosting, thanks. If it was some sort of plugin or special setup I could "install" on my servers I would really pay a decent amount for it though, it would be ideal IMHO.
Gatsbyjs (reactjs based static site generator) is a very good free alternative. It has a plugin which allows you to use WordPress as a headless CMS to create/update content and another plugin which allows to push your the WordPress content to Github Pages (Gitlab or other static site hosting services):

https://github.com/gatsbyjs/gatsby/tree/master/examples/usin...
tbf, Jobs may have been a business visionary etc, but given that every hour of his life was x-rayed by various biography writers and journalists and he was not much of a family man - spending so much time at work. So we should not follow his parenting advice just based on the fact that he was a good businessman. Not that excessive iPad use is good for anyone, just consider it for the right reasons and not because Jobs said something once.
> Drawback with tokens and skipping the DB check is that you can't simply kill a client behaving badly.

You can solve this with a token/user blacklist. There are desirable (and undesirable) characteristics of using a blacklist instead of a whitelist, but you don't lose this capability.
If you use it for authorization only, it doesn’t.
Man I miss the Far Side
Sorry, all five. I wrote the comment with three, then thought more data would be better and tried two more.
"Days after Hawaii alert gaffe, Japan issues false alarm about a missile launch"

https://www.reuters.com/article/us-northkorea-missiles-japan...
Perceptions of research and strategies for reading papers depend on career stage