skysight-inc/HackerNews huggingface dataset:
No, Tibetan book of the dead is orthogonal to Buddha's teaching. People attempted to mix them but Buddha's teaching was only able to be correctly revealed in each detail by a Buddha due to only him having a high enough level to see things as they are (that's why he called himself a Tathagata), so people can't help but change it by adding their own thoughts and ideas. When we look at cases of a special teacher showing a reaction we must confirm every exact detail in context or we will likely completely miss some critical qualifying detail. Buddha didn't see the concepts which religions of the day promulgated so he didn't teach concepts from them. They were naturally imprecise or wrong in some ways. Each object and each living creature has its own self; for example an apple tree only makes apple fruits, and if it changes what is in itself due to a change in its environment then it's a fact that its own truth changed. People who are not enlightened can't see, so they make things complicated due to thinking and learning others' ideas without knowing the world. That's why someone who could actually see things - the enlightened being - had to come to the human world. No one expected what he told people. Most /wanted/ Atman to be a real thing - perhaps that's why Buddha was shunned while he was alive. Hope that makes some sense for you.
Instagram to Automatically Filter Out “Bullying” Comments
User namespaces can already get you this, but this is an added layer of defence in case their are exploitable kernel vulnerabilities that could allow an attacker to break out of a container. With this runtime if you break out of the container you are in an isolated kernel. As others have pointed out though this is basically just a stripped down UML, so the performance is likely not great. Though in contexts where security is at a premium (compliance contexts for the healthcare and finance industries) it might be worth the cost.
TBH I want solutions that work for all logins, not just a select few.

We need the OS makers (e.g. Apple, Microsoft, Google) to create a standard protocol for login windows that apps like 1Password, LastPass, Dashlane, etc can use. We kind of have it on iOS but not all app makers got the memo. Although I fear that they'll end up pushing for their own managers, taking business away from the password managers that are saving us.
I don't agree with the paragraph on databases, unless there is an implicit assumption that you're migrating an existing database.

- dismissing DynamoDB unless you're doing "just key/value pairs" is IMO too reductive. You can go a long way with DynamoDB, and for smaller tables it has the most bang for your bucks (plus it's dead easy to set up and configure)

- building and maintaining your own DB cluster should not be your first move, even if you think you need "a high level of engineering". Start with a managed RDS instance and only if you reach its limits should you consider rolling your own (unless, of course, you already have an exquisitely tuned DB that you need to migrate to AWS. But honestly, as long as you're migrating, shouldn't you take the opportunity to move to something with less maintenance?)

- managed RDS is fine, but, once again, DynamoDB will frequently be cheaper.
GDPR Transparency and Consent Framework
No, GDPR requires you to delete all the data corresponding to a user within 30 days after the said user requests deletion of account. That includes backups and logs.
Seconded

The usual cargo-cult thinking usually ends up with someone leaving their 1024 bit secret key under the doormat, or worrying too much about nation states hacking your routers instead of worrying about Bob clicking a suspicious link.
Yeah some people I know go OTT and use password managers for everything. To the point that they don't trust any cloud based ones so if they want to log in to something and they haven't got an up-to-date copy of their password manager db on them, they can't.

My system is two or three "disposable" passwords I use on low reputation sites or sites where I don't care about breaches. I don't care about people knowing it either, if someone asks and I trust them I'll more often than not tell them what it is. Services where compromise would actually affect me get stronger passwords: my Google and Amazon passwords semi-random generated, but sticks to a format so I change parts of it and never forget it, and I check to make sure it's not in breaches every now and again. I use variations of it for my bank, medical stuff, etc where a breach could actually have implications for me.
I think you best bet would be to use either real world population density, or connected users density to scale the communication distance, so that people don't have to stay alone, and at the same time you still have a meaningfully limited range.

I don't think anyone will just stay connected alone in the hope that someone else may connect later.
Are Google and Facebook Undermining Europe's Privacy Rules?
The danger of absolute thinking is absolutely clear
> So, it seems like the logical extension into cyberspace would be that you can do anything you want to the attacker's computer while they are connected to your systems, but you can't pursue them once they've gone, the same as kinetic castle doctrine.

That's more or less what I'm imagining, not after the fact find-fix-finish.

If I come home from work, power on my machine, and find someone is DoS'ing my connection should I be able to route through an alternative connection and take down the offending machine?

Honestly, I don't know how to feel because there is greater potential for collateral than with, say, a man in a ski mask kicking in my door. At the same time wholesale denial of "hacking back" seems the like the wrong[0] approach.

[0] - I realize many an HNer lives in a land with a duty to retreat so this might be foreign to them.
It’s likely that web apps and servers will be least affected, I cannot imagine the performance on databases being good.
how do you know it? There's no quote
Can you clarify this part:

[...] since C doesn't have a portable way to denote single precision float constants [...]

That sounds like the suffix 'f' which you're also using, how is that not a way to "denote single precision float constants"?

My draft copy of the C11 spec says:

An unsuffixed floating constant has type double. If suffixed by the letter f or F, it has type float. If suffixed by the letter l or L, it has type long double.

But this is not new syntax, I just looked in the most recent document I have.

Do you mean that C doesn't have a way to require IEEE 754 floating-point?
> Generally, those rocking Nike, Adidas, even Supreme are not accepted by those who support skate specific shops and brands.

The situation is much less clear cut these days. There are the die-hards that will never ever buy those newcoming brands, sure, but Nike and Adidas skateboarding offshoots do embrace the culture and sponsor great talent with a genuine skateboarding spirit like Sean Malto (Nike), Shane O'Neill (Nike), Daewon Song (Adidas) or Chris Chann (Adidas); plus the shoes are objectively good stuff for skating. They certainly have less of an extreme attitude than Ali Boulala and Dustin Dollin, but that never was what skateboarding was about.
That is weird. May I know where are you located?
> The castle doctrine would definitely not apply in that situation.

This is flat-out wrong, at least in the states I'm familiar with.

Most states' Castle Doctrine applies to home, work, vehicles, and property. If I'm out in the country on land used for hunting, the "Castle Doctrine" still applies assuming the normal criteria are met.

If I'm at the site, I have a right to defense regardless of it being my primary residence or a rented facility.
That's a good one, but I'll appeal to authority here and make the fallacious argument that I'm correct because Donald Knuth said so:

https://en.wikipedia.org/wiki/Program_optimization#When_to_o...
Thanks will fix it shortly.
I think they would have to end up far more like ebay where Uber gets a request for a ride, puts that up for a period of "bid" by the drivers who will bid a price for that ride, and then gives that list with sorting options back to the requester to pick from.

Of course, I imagine that sort of process would make it much harder to actually get a ride and make it far less interesting to the users.
تحميل برنامج موبو ماركت MoboMarket سوق تطبيقات للاندرويد وللكمبيوتر
Software development is hard: A collision bug post-mortem
Depending on your threat model, a strong password that is written on a piece of paper on your desk might beat a weaker password that's memorized. That would at least require physical presence of the attacker and if your desk is reasonably secured, that might be ok for a lot of cases.
Service discovery is an actual interesting problem to solve when you don't outsource it to k8s, huh?
Recent version of Postbox switched to the Maildir format, which is still, from what I've seen, not production ready in Thunderbird.
The cash would be grabbed anyway, if not by them then by squatters.
No visa sponsorship, oh no ;/
New court ruling could force Uber, Lyft to convert drivers to employees
There's no standardisation of how to represent ownership across ABI boundaries yet, and different languages' models are fundamentally incompatible: either the VM/runtime expects to own all memory management (in which case interfacing with another VM/runtime that follows the same model is virtually impossible) or the programmer does it manually (perhaps with some help from the language in the case of C++ or Rust). Embedding a language that does the latter in a VM language is always going to involve fiddling with memory ownership in a language unsuited to it (as you do when using SWIG or the like).

What are you actually trying to achieve here? If you're writing a library for use from both VM and non-VM languages, you'll want your library functions to have clear/simple memory ownership semantics anyway, and at that point any unmanaged language will work reasonably well for you. If you just want your library to be usable from several different styles of language, maybe a multi-language VM will work for you.
GCC 8.1 Released
Has anyone tested this using https://www.emailprivacytester.com yet? If not, please do so and report back here. I would test myself but I'm stuck in the queue for access.
Here's a simplest push notification ever: email

It was used by Akamai to do automated billing from the edges in the nineties when it was the first network that billed per byte delivered at the edges with multiple tiers.

It is very easy to kill an annoying mosquito in a room if it can hide in 3 places. It is much more difficult if it can hide in thousands.
> To me this seems like an improvement over having to worry about the full host syscall surface area.

Seccomp already permits this type of attack surface restriction, and Docker (with runc) already has a default seccomp whitelist. So by default you already get this.

> Do you have some pointers where we can read more about weaknesses of ptrace syscall interception?

The basic problem is that the policy runs in userspace and is thus more vulnerable than a kernel-side policy. It also has the downside that you don't get any of the contextual information the kernel has about a syscall if you just know the syscall being called (such as labels or namespaces or LSMs or access rights or what state the process is in or whether another process is doing something nasty or ...).

There's a reason that UML didn't overtake KVM in virtualization. Because it had a worrying security model, since the only thing stopping a process from seeing the host was another process on the host tricking it. Everyone I've talked to about UML has cited security as the main drawback.
Running FFmpeg on AWS Lambda for 1.9% the Cost of AWS Elastic Transcoder
Big pharma are untouchable on TV (the silence around mass shooters and prescription meds is deafening) so my guess is you will soon see more pharma ads on YouTube etc. Can't upset the sponsors now.
I don't see any feedback on what my current location is. I know my home ISP assigns me an IP address that location services place a 100km away from me — users have no way of verifying if their location was picked up correctly.
You're right, the Github page says as much:

> gVisor may provide poor performance for system call heavy workloads.

Incidentally, I find the description on Github much more interesting than the one on the Google Blog: https://github.com/google/gvisor
I normally just use LocalCast (http://www.localcast-app.com/), although there may be a use case for a kind of "jukebox" application using PyChromecast.
There are commonalities...

https://github.com/GoogleCloudPlatform/appengine-java-vm-run...
APL really is no harder to understand than any other programming language, in a way it is easier than most because you can look at the whole program at once without being bothered by all the cruft of loops and such. You're probably mostly thrown off by the symbols.

There was a gorgeous article submitted a couple of days ago:

http://www.jsoftware.com/papers/50/

That should serve as a good intro.
See edit below. C99 allows greater precision than required by the type!

Hmm, you're right.

I think something similar bit me long ago and left me under impression f-suffix for a float is not portable.

Perhaps it's time to read the standard through once again...

Then again, explicit casts generate code that works on all compilers, standards compliant or not.

Edit: C99, 6.3.1.8.2: "The values of floating operands and of the results of floating expressions may be represented in greater precision and range than that required by the type; the types are not changed thereby."

So I guess explicit floating point casts are needed when explicit operations are wanted!
Note that this is just one out of 10 chapters (translated from the author's Japanese book). Lots of other interesting technical details on other internals if you look at the table of contents.
Nike has a huge skate team these days (Koston for example). It's like any major sport now - there's money in it so the big companies have joined in. I'm sure it's great for the skater's incomes and the Nike SB shoes are really quite good. Can't comment on Adidas, but they've been in the game for quite a while now.
Exactly. You're not really crossing boundaries any more, you just have different surface-syntaxes for "the Graal language system".
My favorite thing is seeing people I wouldn't hire to be a low level IT tech as CIO/IT Director because they're a "network guy".

So not only do they end up not understanding 90%+ of IT's functions in any real sense, they are typically not even trained on how to manage.

I work with one such moron at my current job. The entire company goes around the fool, yet they keep him. Why? The acting CEO is likely embezzling and competent IT might shine a light on it. That and the CEO outsources work to her husband's company for 10s of thousands a month with no deliverables or results (beyond what I suspect is the normal embezzlement in other areas).

I've been in this field for ~25 or so years. Maybe I'm jaded by working in consulting/contracting for most of that (and working for myself). I have never worked with an IT Director or CIO that I would personally hire for my own business in that entire time. Being technical enough to make the right decisions and having enough managerial experience/knowledge to be a good manager at the same time is extraordinarily elusive.

Another question is, how do people hire a CIO, when they themselves don't understand IT (or even want IT it seems). They guess or outsource it. I've never seen that work either.
There was a submission earlier on HN about how the Switch is not USB-C compliant: https://news.ycombinator.com/item?id=16706803
Thanks for this suggestion, will consider adding this. BTW, We don't use location from ISP, we get location form GPS. So it will be more accurate than getting from ISP.
It still reads to me like they meant non-HTTPS connections, as that is what they mark insecure in concert with buying the .app domain.

They -could- have meant .app, but we'd need the guys word to know for sure. It's not as straightforward of a comment as you think it is.
Correct, but it does mean that those of us not so found of Go, have to actually use it when dealing with Docker and K8s deployment scenarios, where devops are keen in using it as their tool of choice.

Trying to avoid Go in such scenarios is a futility.
Knotch | NY or Remote | Full-Time | https://www.knotch.it

Knotch is a feedback and measurement platform used by some of the world’s largest brands and distributed on some of the internet’s most popular publications. Despite our product’s success and growth, our team is still very lean and nimble. We believe building a strong engineering culture is the key to building a kickass company and product. Part of that vision is working with the right tools for the job, many of which are open source. Our stack includes Ruby, NodeJS, Postgres, MongoDB, Rails, Grape, Express, Redis, React, Redux, D3, StatsD, Docker, Terraform, Ansible, a lot of AWS, a Slackbot named Gnomie, and that's just a taste.

We are looking for full stack engineers that are passionate about problem solving, learning, teaching, and programming elegant solutions. We move fast and something you start building today may end up in production, well today, possibly tomorrow. We’re a small team, so you’ll be given a load of responsibility as soon as you join. You’ll have the power to take ownership of entire projects or features. You will influence architecture decisions, bring new methodologies to our development process and have an important and impactful say in how we build our platform.

Open Roles:

- Full Stack Engineer

- Senior Backend Engineer

Visit https://www.knotch.it/jobs for more details and to apply. Feel free to email me at michael@knotch.com if you have any questions!
You're right of course, my comment was too short and factually wrong. What I meant was that what they're doing is effectively renting office space in Amazon's building and then exploiting a loophole in the way mail is distributed to receive packages even though the outside envelope says "c/o amazon.com" (or c/o souq.com in this case).

So while they don't do anything fishy on the server side they still took care to put their servers there for a reason. And since they also write the client code it's not difficult to show that the intent is to impersonate Amazon to 3rd parties.

Interestingly it seems that amazon couldn't really complain if the people writing the client were independent from those maintaining the servers since the spoofing code is entirely in the client. Although in the end I'm sure if it turned out to be a problem for they they'd just enforce that the domains match the HTTPS query and remove the technical possibility of fronting altogether.
oops :) meant to be sparse
It looks like it’s at zero to me. My guess would be that is an outside hire.
Ask HN: Should we use Lambda (Google Cloud Functions) for our API?
Hi HN,

I need you.

I'd like to know what is the current state of the art regarding the use of serverless paradigm for API endpoints.

Context:
We currently use Google Cloud Functions for our API. Our startup is young, and just the 2 cofounders are working on it. Our product is a consumer iOS app. The backend is something we don't have a lot of time to dedicate yet.
~1k DAU
~5k Daily API calls,
Traffic spread between US, Europe, East Asia, Australia

Over a classic webserver deployed on Heroku/EC2,

Pros

- easy to deploy

- easy to maintain

- easy to setup

Cons

- cold starts are becoming really long (~4/6 seconds)

- we setup a pgbouncer to connect to Postgres instead of a simple Pooling client (and it will be more complicated for geo dns?)

What do you think?
I hate to rain on this interesting project’s parade, but if you need full sandbox isolation then you should probably look to full VM isolation (ala Kata containers, formerly Clear containers). User namespace-ing, SecComp, and Selinux/apparmor buy you about as much of a sandbox as you’ll need, with the one caveat that a kernel exploit could still take you down (all other exoits are rendered sandboxed).

If you need that final kernel sandboxing, then a full VM is your only guarantee. UML still sits on top of an exploitable kernel, and presumably this project itself can be hacked. While it certainly is better than nothing the only thing it seems to be buying you above Kata containers is a faster spin up time and the ability to dynamically resize the container. Maybe that trade off is worth it to someone, but the added performance overhead and the demi-kernel isolation seem like a high price to for those features.
Two precautions I’ve gotten a lot of mileage out of are regularly hosing my outdoor boots down with repellant (most ticks are coming up from the ground and for short walks your boots are your only ground contact) and leaf-blowing trails (ticks prefer leaves).
We're not talking about people recently moving to SF.
Absolutely. But the OP forgot the "Great work but...". Had they, I wouldn't have commented.
Amazon reportedly makes offer for a majority stake in Flipkart
Only if you live somewhere that blocks it.

And I suspect even then, you could still use a Signal server hosted by someone else.
Do you still have this? That would be a very nice project to share.
CHECK24 (www.check24.de) | Germany, Cologne | PHP Developer | Onsite

CHECK24 is Germany's leading online price comparison platform. Our office in Cologne is currently expanding its team of about 25 developers. We especially search people for the backend/core team.

Some facts about our architecture:
- PHP 7.1
- Zend Framework 2 (moving towards 3)
- big focus on code quality instead of speed
- free choice of hardware (Windows, Linux or a MacBook)

We can offer benefits, such as great career opportunities, a free lunch every Wednesday, flexible working hours, free drinks (such as coffee, tea, water and club mate), bimonthly drink outs and much more!

A quick view on our interview process: It consists of two rounds. First one remote via Skype/Phone and the second one on-site, if possible.

To apply visit https://jobs.check24.de/standort/K%C3%B6ln and pick the appropriate job.
If you got any questions you can contact me at s.hofmann@check24.de
Apparently Firefox locates me at 50.6138111,3.0423598999999997 (which is actually 3 km away from where I am, but that's not your fault) but your API responds with {"message":"Invalid location co-ordinates."}.

Maybe it's a problem with the decimals in 3.0423598999999997?
Uh no, this is actually more like the man plastering the city with "all is well" posters: that the tension between CMB and SN determinations of the Hubble constant will be resolved by fixing some tricky detail in the analysis is the most mainstream expectation out there.

The tension has been there for a long time, but its only something like two years ago that the statistical errors got small enough you had to somewhat seriously consider there could be some important reason for the disagreement.
Next: Minimal CSS font-size system CSS framework!

Simple naming system! Only 0.5KB!

.ten { font-size: 10px; }
.eleven { font-size: 11px; }
.twelve { font-size: 12px; }
.thirteen { font-size: 13px; }
.fourteen { font-size: 14px; }
.fifteen { font-size: 15px; }
.sixteen { font-size: 16px; }

Plugins available for font styles & variants!

.bold { font-weight: bold; }
.italic { font-variant: italic; }

Use our CDN! Always available!

https://mincss-fontsize.xyz/simple-font-sizes.0.3.1.min.css

https://mincss-fontsize.xyz/simple-font-styles.0.3.1.min.css

https://mincss-fontsize.xyz/simple-font-variants.0.3.1.min.c...

Changelog:

0.3.1

- Changed .sixteen to be actually 16px instead of 17px (typo)

0.3.0

- Added .sixteen for even larger text!
That's what Google did here, by having an early period during which domains cost more.

And this is the predictable response: https://news.ycombinator.com/item?id=16972813
AI Researchers Are Boycotting Nature’s New Machine Intelligence Journal
Overleaf v2 now open to everyone
Dnata’s cargo operations at Dubai gains IATA CEIV certification