skysight-inc/HackerNews huggingface dataset:
> At Microsoft, the core of our vision is “Any Developer, Any App, Any Platform”

This is what you want us to believe. But this makes little sense: if you really believed in "any platform", this would go against your the interest of the company (Windows sales), and therefore also against the interest of shareholders. I liked you more when you didn't pretend.
Biggest change is a pretty accelerated deprecation of the publish_actions permission, effective now for any new apps and August for all apps previously granted this permission.

This is the permission required for an app to post on behalf of a user.

On the one hand, it is nice to see this oft-abused method abolished. It was always a bit of a joke that you could get approved for it and then have to adhere to a bunch of hand-waving policy around "but don't fill in the user's message for them" without anything technically standing in the way of abuse.

This will kill many FB apps. And for everyone who has been on the treadmill of having to update their apps for API changes every 4 - 6 months, this is probably the straw that breaks the camel's back for abandoning the platform as a whole. What with having to pay for content distribution through promoted posts, and the constant API churn, it just isn't worth it. Fine.
As someone short TSLA 5.3% debt, at least at high 7-8% on these bonds you are getting paid to take some risk
The buffers maintained by the OS and drive are totally different, the entire point of having huge buffers in the device is so that it can agglomerate and reorder otherwise totally unrelated writes into flash banks it is presently convenient to write to.

When the OS flushes stuff to the device, it is done such that metadata writes reach the disk in an order that ensures a recoverable filesystem image on power failure. If the device does not preserve that ordering all bets are off. The mapping that goes on inside a SSD is of sufficient complexity that it's much easier to simply guarantee the device has enough independent power to ensure all acknowledged writes are persisted after acknowledgement, and that means capacitors, or best case, data (e.g. committed, acked DB transactions) that magically disappear during a power loss event.

You cannot have a device that temporarily writes to RAM and tells the host computer "OK that's on disk now" (i.e. every SSD in existence with a throughput exceeding a few MB/sec) be reliable without an independent source of power to ensure that RAM reaches flash in every situation
> In the years I have lived without a car, my example of walking everywhere has tended to popularize walking wherever I lived. (Yes, even when I was homeless.) After seeing an uptick in walking, you could see visible evidence of improved air quality, such as healthier plant life in the area.

> Crime also went down. In the apartment complex where I gave up my car, the cops stopped staking out the entrance on weekend evenings. In another city, helicopter manhunts and similar police activity trended down.

This is a pretty fantastic, and frankly unbelievable claim.
No, BGP is actually terrifyingly easy to hijack and it's surprising this doesn't happen more often. There's really nothing at the protocol level to indicate that the router you're peering with is actually authorized to advertise the routes they're sending. I could configure my company's edge routers right now to advertise these same AWS ranges if I wanted to and those would be sent to our upstream peers.

What can be done is filtering the routes you receive from peers. Any ISP that knows what they're doing will coordinate ahead of time with their customers which routes the customer will be advertising, and whether the customer really owns that IP space. Then the ISP sets up rules on their routers to only allow those specific networks to be advertised by you, and drop all other advertisements you might send. This can be done manually via a Letter of Authorization, or by querying some central registry like http://www.radb.net/. But clearly it can be done incorrectly or not at all, and that opens the door for route hijacks like this one.

BGP is an old, old protocol in tech terms. The RFC for the current version dates from the 1990's. The go-to textbook reference for it (Sam Halabi's Internet Routing Architectures) was published in the year 2000 and is still considered up to date. It's really not equipped at all for the sophisticated threats seen on the modern internet.
Ask HN: How to self learn economics?
Strange that you are getting downvoted. The second half of Diamond Age is all about how Hackworth’s manipulated version of the book, given to the Chinese orphan girls, causes them to grow up into educated and skilled robots who need a strong external leader in the form of Nell. Nell’s success comes from the fact that she was lucky enough to also have strong role models.

This should strike even more alarm bells at a time where we are worrying about the pernicious effects of social media and maliciously targeted material (including material targeted to children).
If you have a desktop you can buy a $10 PCI express adaptor for it.
You won't believe the number of crazy people in Germany who believe that static IP addresses are the root of all evil because of all the magucal tracking and surveillance possibilities they famtasize about.
> * Pick a preferred SSL issuer and stick with them. Add a CAA DNS record only allowing that one issuer.

It may be worth also suggesting HPKP here. That would be effective for many customers.

> * DNSSEC? Make sure to choose an SSL issuer that will correctly test DNSSEC?

This basically means you can't use Route53, which is a deal-breaker for a lot of people running services.
Depending on how much you've earned during the year, a Roth IRA may not be an option (exact threshold I've forgotten but it's around $120,000)
> If there’s any book where the author would control the printing, it’s this one.

I agree. My point is that the final, bound form is probably not available for approval. The author sees and approves pages before they are bound. He probably did not have a bound paperback in his hands until the first print run. Only then could you judge how the choice of center margin did not work with the other choices.

He may have had approval over the method of paperback binding, but a number of variables are conspiring to make the final spine stiff enough that the pages kind of disappear into the binding. Some of those were the variables the author apparently approved - the paper choice, the page dimensions, the margins.

I will add that the layout really looks like a hardback layout. I think that was forefront in the author's mind.
> Sure, if you want to think of the thing that is formed by all combined requests from all clients over the lifetime of the database, as a program

The thing that serves responses to requests is a program. And it's not just a "simple, dirty request handler script," it's often enormously complex. Entire companies exist with their product exposed via HTTP APIs.

The reason you don't see exceptions in databases, operating systems, etc is because they're often written in C++, which has notoriously wonky semantics around exceptions, or C, which doesn't have exceptions at all.
(self-promotion) I've created an open source C compiler written in Python (https://github.com/ShivamSarodia/ShivyC). I've learned a ton building it out so far, and I've found compiler design to be a great exercise in software engineering and learning Python since managing the complexity of a compiler is nontrivial. If you're interested in contributing, a good place to start is by tackling any of the issues marked as "good first issue".
So you need to buy DRM lightbulbs?
I think part of the problem is that the author seems to ONLY be a ruby dev, rather than a polyglot, able to use the right tool for the job.
I personally use the Samsung PRO SSDs myself these days. I don't go with the latest models because the older NAND technology tends to be more reliable. Also you want a company with many product cycles so that the firmware has time to mature. Just too many edge cases in SSD firmware to catch them in one go.
Lessons Learned: From a Founder Who Started a Startup in College
erlangs bit matching syntax, case statements for structs... incredibly elegant. I don't know about Rust or Lua, maybe they have this too.
IMO the BEAM run time is ideal for it.

If I were writing code to drop onto a small device, I’d want the capability to efficiently have a lot of things run at the same time with a small processor, to know that a single heavy unit of work wouldn’t negatively affect the responsiveness of everything else and to know that all of those tiny pieces were built to basically never go down.

Personally speaking, it would be difficult to imagine using anything else for that type of work.
Not an Erlang user, but I'm tickled by the idea of having a reliable cluster made out of unreliable little computers. Erlang has a great reputation for process supervision.
neat, i like the design. Just wondering how would you monetize such an app. maybe you can add ads here and there.
MIT Publishes a Plan to ‘Destroy’ Bitcoin
The problem is particularly bad for packages sent to condo buildings. Amazon pickup points are good, but still require you to go pick it up (and delivery notifications are usually quite delayed for me for some reason).

I've been throwing around an idea where condo residents can sign up to be a package hero and accept deliveries on your behalf... maybe even deliver to your door on demand. Is there a reason this doesn't yet exist? Just trust or something else?
MyEtherWallet (which was the target) has an EV SSL certificate. That could be why they couldn't get it as easily.
"Closed as duplicate" is such a frustrating experience with SO, especially since the canonical answer for the original post so often has so little to do with the supposed "duplicate" post, other than a superficial similarity in how the question is posed.

E.g.:

Q1: I'm trying to do x and it isn't working.
A1: You're missing a comma in the list on line 7.

Q2: I'm trying to do x (and I've checked all of my commas), and it isn't working.
A2: Closed as duplicate of Q1.
I wish them massive success. Glad to hear someone is at least trying for large scale cleanup. Also glad the article mentioned needing to attack the root cause as well — in some ways it’s harder because it’s a political/economical/cultural, not engineering problem.
Other big German providers just fail at this. O2 for example only hands out IPv6 addresses very selectively based on whose lines they are renting in the area. I have no chance in hell of getting an IPv6 prefix from them.
I would def feel more comfortable paying for it and having an ironclad guarantee you wouldn't use my data to stay solvent / pay for bankruptcy down the line.
I'm curious about the transition from C/C++/C# to Rails/React/Angular. What did make you switch?
A CAA DNS record won't help much if the attacker can just go to the certificate issuer and request a valid SSL certificate because they own DNS. Plus can't they just change the CAA DNS record?
Desktop power supplies already have that, they can keep the power on for 50-100 ms or so, and they do notify the OS about the imminent power loss. I'm not sure what OSes do with that.
7 Cloud Computing Predictions for 2018
I guess this is the part where they Embrace the overwhelming trend towards cross-platform tooling.
Perhaps you aren't familiar with Jane Jacobs' work. Her position was that eyes on the street was the key to safety in urban areas. This is that mechanism in action.
There are billions of galaxies though, so even if we are the only planet out of billions in our galaxy with complex life, there could still be billions of civilizations out there!

For that matter, the typical planet with life could be too large and have too thick an atmosphere for space travel or astronomy and thus never have any idea the rest of the universe exists. That wouldn't necessarily mean life was limited to single cells.
Also depends on what they're counting in their percentiles.

You can pretty easily hire the top 1% of applicants, and still get only mediocre results. E.g. at one job, when looking for a senior-level eng position, clearly stated in the description, we easily weeded out a couple hundred applicants who had effectively zero experience whatsoever. No prior programming-related jobs, internships, side projects, open source, nothing.

Which is a waste of time for everyone involved. Hence the heavy reliance on connections :(
Smartphones + social media apps = unlimited ice cream. Being aware of it is the first step: http://humanetech.com/problem/
> * Why would HSTS help in this case? While HSTS is active, does it prevent clicking through the warning (which was done here)?

Yes, HSTS (if preloaded or cached by the browser) prevents clicking through the warning, although there's a secret code you can type in chrome? to get around it still.

> * CAA record

Yeah, a CAA record wouldn't help. Presumably the CA in question is going to want to get that record freshly, and while the DNS is hijacked, they can return whatever they like. DNSSEC could conceivably help, but that's a pretty big can of worms.
Show HN: Calculators that provide insights on how to improve your finances
It's actually even worse than this, in that long-ago written data could be in the process of being refreshed/remapped when power is lost. The drive's software should be designed to work atomically to prevent this, but that's a whole lot of edge testing we're hoping a company will do on its closed software.

Which is why things like cheap SD cards are notoriously unreliable, whereas Samsung SSDs are seen as decently reliable. What we really want is to get rid of these controller layers and let the OS directly manage the flash. But top of the line manufacturers are incentivized to decommodify their products to increase margins, and price-competitive manufacturers are inclined to stick to the same interface.
Apple loses $64B in stock value as Wall Street is in 'full panic mode'
Sure, just like today's disabled people are not left to die on the streets. Many disabled people never had careers to begin with so it is not a massive change. And you could always opt in to some form of disability insurance.
In The Diamond Age, it was very advanced AI that included software specifically aimed at social interactions -- plus a kind of trust fund that paid for hiring "racters" (character actors) in certain circumstances.
I thought the whole point of certificates is that you can't generate a legitimate one for a domain you don't control

But they did control it. The domain's name servers were pointed to route53 ips, which were controlled by the attackers. If they setup a dns server, they can point those entries to any server they want. They certainly could have gotten a dv ssl certificate for any of the domains affected.
The issue with IPNS is it's based off of public private key crypto which means the "domain" is a hash and has no name recognition. While still useful, it's not going to make its way into the mainstream anytime soon.

For instance, I host my personal site on both IPFS and normal web traffic.

https://fn.lc/ipns/Qmea45XwFtdwaCGAPLRMxFmoUP5YLnknc2WGCGQ3H...

https://gateway.ipfs.io/ipns/Qmea45XwFtdwaCGAPLRMxFmoUP5YLnk...
I'm a senior engineer and have worked with recruiters many times before, and I've pretty much come to the conclusion that they're a big waste of time unless you want to do the 6-month contracting thing to avoid resume gaps or you just like moving around the country and renting rooms.

I've tried working with them before, have gone on job interviews through them, and then generally found that the jobs that hire through recruiters pay peanuts, and I end up finding a permanent job paying much more and taking that instead. I think if a company only works through 3rd-party recruiters, that means the company has no idea how to hire people, and doesn't want to pay much either (because they're paying the recruiter a huge commission).
I stopped tinkering with my system configuration and started using it for the things I want to do as opposed to the things that get in my way.

>You can install a Linux distro aimed a people not interested in tinkering and it will likely just work.

Ubuntu didn't "just work". Is it aimed at tinkerers?
Instagram launches “Data Download” tool to let you leave
This was introduced to solve this specific problem https://www.amazon.com/b?ie=UTF8&node=17337376011

It requires buildings to sign up though. There are also services like Parcel Pending that solve this problem.
Open Autonomous Safety from Voyage
The Google/Facebook comparison is made because those companies also deliberately ignore the user's privacy wishes.

Also, this isn't about locating someone to their city. According to the blog post, it returns latitude and longitude pairs.

Yes, these may not be precise in some circumstances, but as detailed in many recent HN posts, Google has many many ways to narrow that down to a very close approximation of where you actually are. And it's only going to get better at it over time.
Vintage leather handbag hotsale women
That proof of ownership is generally "publish a DNS record or a file at this specific URL", both of which hijacking DNS would permit you to do.
IMO Diamond Age feels way less like a recap of Stephenson's reading list than some of the others. Worth a second look if you're on the fence and looking for a good story.
I think it's worth experimenting with a more diverse and distributed model because the 'one megahub' structure also has disadvantages, low spread beyond the borders of the tech industry being one example.

Especially countries like Germany with diverse industrial production spread out across the country might benefit more from having technology clusters spread out as well.

Even Silicon Valley companies like Google have at least partially taken on this approach by opening labs in Toronto or Paris, Amazon plans to create about a hundred jobs around Stuttgart and Thübingen.
I find systemd to be an over engineered pile of trash that keeps infecting more and more of the Linux ecosystem because nobody wants to stand up to redhat and their push for more poetteringware
There are a lot of technical ways to get around this but here's a simpler approach. I just don't own a smart phone. I own an old flip phone and use it primarily to communicate with my immediate family through texts and calls. I have the advantage of not being required to have a smart phone for work and I'm quite happy with that situation.

I generally don't use facebook or pretty much any other social media sites (hacker news is probably the most social I get) and whenever I need to I just do it from home, I like my time.
And at the time the 2G on TMobile was just as fast if not faster than ATT 3G which was ironic.
You got into the smart phone game fairly late, or you don't use them heavily.
> Number 7: Companies Really Want to Know Your Salary; Don’t tell Them

This can easily result in wasting your time interviewing for companies that will never be willing to meet your salary expectations. Unfortunately, a lot of companies aren't up-front about how much they're willing to offer, so I'm not sure what the solution is.
It's definitely not my experience in the DC area. There's certainly a lot of pickiness, but I had no trouble getting multiple offers here recently, the main problem was that some of them didn't want to pay much. I ended up going with a company that's on a hiring spree and beat my asking price by a good bit.
HSTS does indeed prevent users from clicking through the warning - it makes handshake / trust chain failure fatal with no "proceed anyway" button.
I've used the one made by startech, $30 on Amazon. Speed is always going to be limited, but they do work. I've used it only for general IT work doing data transfer, backups or upgrades where the host system didn't work or support multiple M.2 connections.
Does anyone know if this happened to affect Amazon's Seller Central?

Amazon sellers (including me) couldn't access their control panels for several hours last night.
They do require proof of ownership, but it's recently become common to support validation by proving that you control the domain or web site being validated so that the proof is purely electronic, e.g.:
https://www.godaddy.com/help/verify-domain-ownership-html-or...

In a case like this, the attackers had sufficient control to pass those kinds of checks - although people are saying they didn't do that, and just relied on enough users clicking through the certificate warnings.
How come it’s still allowed on the front page in that case?
Do You Agree with These Fitness Diet Ideas?
This is my attempt at applying the recommendations, but with an updated style:

https://texify.davidar.io/WebTypography/
"That guy didn't have 20 years of experience with db2... He had 2 years of experience, 10 times."

One of my mentors said that about an interview he conducted a while back. I found a lot of truth in that line. I run my tech interviews by starting very green and let the candidate dictate how fast I ramp it up. I've gotten pushback from managers before that you can't start with basic questions, but I've equally gotten positive feedback from candidates (even one's who've been failed the interview). In the end, programmers want to see an algorithm that allows them to judge an interviewee. I don't believe one exists.
Looks nice. Having the immediate "Click here" that leads into the edit page with the double paned edit window is particularly cool.

Watch out with providing a hosted version of something like this with totally untrusted user input. JSON schema allows for arbitrary regexes for field validation which means a malicious user could easily bring down the site with a nasty regex[1]. Not a concern for anything privately hosted but sadly there are plenty of jerks in the world.

[1]: https://www.owasp.org/index.php/Regular_expression_Denial_of...
On Facebook, you can create updates that your friends will see and consume updates from them. While these updates go through some filtering and sorting, they are still much more decentralized than curated updates from newspapers and TV.
I’d probably pick the ones who interrupt the coding exercise, tell me how ridiculous it is, and tell me about the ways they’d solve it in plain English / pseudo code.
The Backdoor Roth IRA circumvents this. In short, you invest in a Traditional IRA and convert the contribution to a Roth IRA. https://www.bogleheads.org/wiki/Backdoor_Roth_IRA