skysight-inc/HackerNews huggingface dataset:
And if it’s not the same code base, it’ll probably be buggy, because it’s not the UI people normally use.

Server-side rendering of the same UI avoids that hazard, at a much lower cost.
fortrabbit | Go/PHP Developer | Berlin | ONSITE | VISA | €50k - €60k | https://www.fortrabbit.com

fortrabbit is PHP as a Service — cloud hosting dedicated for a modern PHP. More dev, less ops for web designers, startups and digital agencies. fortrabbit is a small and fine bootstrapped company located in Berlin Kreuzberg. If you've ever wondered what it’s like to build and grow services for yourself, this is the place. We use our own services every day to be more productive in our work. We take work seriously and expect each person to be self motivated. You will join the small team in an important position. While we are mostly PHP, GoLang is also a requirement.

tech stack: GoLang, PHP, Laravel, AWS, Linux (Ubuntu), Apache, HAproxy, NGNIX, FPM …

https://fortrabbit.breezy.hr/p/1ea397f4fb5e01-go-php-develop... or fl@fortrabbit.com
They expel you or they sweep it under the rug and do nothing at all.
Native Brit too - I think it's more of an "industry" term, across food service companies, whereas is in general use in the States. Might be an Americanism though, but have heard it pretty commonly here when in food prep circles.
The same technique is being used to prevent censorship in a host of countries, like UAE, that have giant piles of cash and influence, and where blocking AWS/Google would have unacceptable consequences. No one gives a damn about a few Russians.
In other words it's Amazon and Google who are willingly help censors to avoid a bit of collateral damage during strikes.

It's like helping Assad to find targets where people with opposing views live.
Why do you spend 2 year of your live to build a new email client? Aren't there enought software for this scope?
I think the point here is to provide an example showing how different compilers implement certain aspects of source code. There is no implication that you should be able to depend on exact floating-point comparisons in programs.

We avoid depending on exact floating-point comparisons, not because of any inherent indeterminism in that comparison, but because it does not generally yield exactly what our algorithm needs.
It's exactly this setting of low expectations from tech companies that work with billions of user's data that has taken us to where we are.

A majority of Facebook user's aren't'techies'. It was Facebook's responsibility to make such features available/easy to access in the first place. It shouldn't have to be a legal requirement. Google/Twitter doing or not doing it doesn't have anything to do with it.
NIST Issues Call for ‘Lightweight Cryptography’ to Protect Small Electronics
Hoo boy, I'd forgotten about Mr Noseybonk (and his dildo farm O_o), though by the time that was aired I was ~13 and kids TV was less of a thing for me. I did like Vision On. A real favourite was Mr Benn, I used to love his adventures:

https://www.youtube.com/watch?v=7goleREp884
No thanks, it’s far better to handle your own user authentication and not depend on third parties.
The first example is about optimizing away multiplication by zero. The second is about GCC treating float literals with greater than float precision, and the third is about dead code elimination.

Not convinced your comment is relevant.
Very different. It's also very different to Solaris Zones. The design of Linux containers is namespace-based while Jails and Zones are (basically) ID-based.

In addition gVisor is basically a ptrace wrapper around your process that applies restrictions and other things on top of containers. I don't really understand what the benefit is over seccomp-bpf (which is slowly becoming as powerful as ptrace but without the overhead and without the security flaw of your sandbox rules being entirely in userspace without any protections like seccomp). They call it a kernel, likely because it is based on the idea of USL (User-Space Linux), but there's a reason that USL never took of as a virtualisation tool -- its entire security was predicated on ptrace to trick processes spawned in the "guest os" into not being able to see the host. In this configuration it looks like gVisor is using both namespaces and ptrace -- but then you have to worry about the massive overhead of ptrace (it affects every syscall and signal event involving the process, and requires four context switches and signal delivery to the tracing process in addition to the normal syscall costs).

gAdvisor appears to be working on a KVM shim, but I'm not quite sure how you can use KVM and still differentiate yourself from Kata Containers (the project that came from Clear Containers and HyperHQ). Seems like duplicated effort to me.

EDIT: I just re-read the article and it looks like they don't actually use containers at all. Unless I'm mistaken this means that they are not taking advantage of any of the sophisticated security primitives in the kernel that ordinary containers use, and thus have the same (bad) security model as UML.
Weird. I had the opposite experience. He's seemed to be working pretty hard to enforce the law with empathy while also trying to understand the broader implications for our society.
For some reason, I only get a red message saying "Invalid location co-ordinates." when I try to post something (not that I expect anyone else to be within 1 km of me anyway).

On Firefox on desktop, clicked "yes" when asked to share my location.
I prefer Sublime Text.
This seems neat, but every time I read about something of this sort, I am left wondering: what's wrong with the pledge/seccomp model? According to TFA:

> Kernel features like seccomp filters can provide better isolation between the application and host kernel, but they require the user to create a predefined whitelist of system calls.

Isn't that something you'd effectively have to do anyway if you want a sandbox? Like, a sandbox isn't worth that much if you don't define what it can and can't do, no?

I'm far from an expert in this area. It's an honest question, not a veiled criticism.
Money quote from https://github.com/google/gvisor for Linux folks who have been around for a while:

"gVisor's approach is similar to User Mode Linux (UML), although UML virtualizes hardware internally and thus provides a fixed resource footprint."
Cultural Evolution
Ask native thunderbird developers, why Thunderbird take 400 MB of RAM, only after start the programm.
BidMotion | Senior BackEnd Engineer | Paris | Onsite, Full-time | Visa | €80K - €100K
http://www.bidmotion.com/careers#op-235702-senior-backend-en...

We are looking for a Senior Backend Engineer experienced in low latency high throughput distributed systems.

We are currently handling over 3 million HTTP req/min, more than 20 TB of data, and projects spread across 120 servers. We are bidding for ads real time and growing on a daily basis.
Simply put; we need someone who knows how to handle a lot of data, really fast, and horizontally scale the system.

Requirements:

- 4+ years of experience in low latency high throughput distributed systems

- Ability to make and take responsibility for high level technical decisions

- Knowledge of stream processing (Kafka, Spark...)

- Experience with key-value stores (DynamoDB, Aerospike...)

Bonus points:

- Java or JVM language experience

- Experience with resilient software design

- Knowledge of microservice architecture patterns

From us to you:

- International work environment fully in English

- Located in central Paris

- 50% public transportation covered and meal vouchers

- 25 days of paid vacation, private health insurance, opportunity to work remotely

- And of course, very competitive packages

tl;dr: We’re small, but shooting for the stars. If you are looking for a place where you can make a huge impact and grow, come join us.

Get in touch with us hr@bidmotion.com or check other openings http://www.bidmotion.com/careers
Uber and Lyft drivers could get employment status under California court ruling
Elasticsearch Development Constitution
No. The cartoon steamboat Willie should enter public domain. You should be able to create a character based solely on steamboat Willie but none of the other films. But you couldn't call him Mickey mouse was he is (and sighs be) protected by trademark
Just recently Estonian Information System Authority published a new report (including new guidelines for passwords) basically telling: "Drop password requirements, allow long passwords and restrict the use of short and top-n passwords".

Why I'm mentioning this is because now I have an actual official document I can send to Estonian companies in addition to my own words (that weren't previously believed, ugh) why their requirements are inane. I think this kind of behaviour shows that we actually need some kind of monitoring or regulation here to build more secure software for everyone.

Also as you mentioned bad-"strong" passwords, I "love" how something like "Qwerty!1234" satisfies most requirements but "8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4" is not okay because it doesn't contain an uppercase letter or a symbol.
Over 60 conservatives demand Big Tech end
Maybe not with Freshmen, but Seniors sure.
XPS Presentation Builder – Created with JavaFX
How Entrepreneurs Make Great Decisions (& how they survive colossally bad ones)
My concern is with faulty code when checking this list.

if (isPwInBlackList(propossedPw))
throw new Exception("Proppossed pw is in black list");

logger.info("Password {} is OK.", propposedPw); //<-- faulty code here
No way. This is the future of the internet
Create text based GUIs in Java
How do you measure the distance ? postgis ?
Bug report: hitting ENTER n times sends the message n times. Until the message box is cleared.
Jeff Bezos Knows His Milton Friedman
Privacy by Design: Building a Privacy Policy People Actually Want to Read
On RHEL 7 (and derivatives), by default, SSH keys are generated on first boot and with entropy acquired from /dev/urandom.

It is possible, however, to force it sshd-keygen, sshd, et al., to use /dev/random instead (by setting "SSH_USE_STRONG_RNG" in /etc/sysconfig/sshd to a value >= 14). In this case, would keys still potentially be at risk?

---

For a while now, I've been generating my SSH host keys at the end of the kickstart installation process (for physical hosts) with SSH_USE_STRONG_RNG=32 (in a "%post" script).

Virtual guests (KVM) still generate theirs on first boot, but they have the benefit of access to the host's /dev/random and also get a random seed "injected" into their disk image just before first boot -- although I'm not sure if that helps with this issue.
An ideal solution would be to define cells based on clusters of people and connect anomalous persons to the nearest cluster. This should not only provide an optimum groups sizes based on an area's population, but also allow remote users to interact.
The field really needs this so good luck. I'll test the first release that works on my os.

I
Indeed, my final year project was to build a functional programming language that macro expanded into lambda calculus the transform that into different sets of combinators and look at the performance improvements.

To this day (almost exactly 30 years) - I am staggered that you can express Y in terms of S & K. I know this follows trivially but actually having coded it and watched it run (slowly) did made it very real to me.

NB This was running on an Orion minicomputer with rather limited memory - I had to implement a mark and sweep garbage collector to get expressions of any size to run!
Because it says dating :) Registrars can device on a set of names the wish to withhold, they are usually dictionary names with great interest involved.
My biggest bugbear is with the really important sites like Apple and Google who force you to type out your passwords several times a day when using their services. I really want to pick a long complex password, but not if I have to keep typing it into login screens or pop-up windows where password managers don't work. Microsoft is doing a lot of good things in this area with passwordless logins and asking for PIN codes instead of passwords. I wish Google and Apple would follow suit.
You'd be surprised how many devs nowadays still have no idea about floating point numbers.
Do you have some pointers where we can read more about weaknesses of ptrace syscall interception?

To me this seems like an improvement over having to worry about the full host syscall surface area.

Until nested hardware virtualization is broadly available, I cannot run things like clear containers on major cloud vendors, so I'm pretty excited to have a way to increase the isolation between containers ... well, unless you point me to something that shows that all this is moot.
American here (Midwest), I've only ever heard it used in the sense of definition 1. It's always been utensils to me, never dishes or containers.

In my area, flatware == silverware, but not necessarily silver.
Talent Partner
Leading the recruitment efforts here at Memrise
It also ignores that seccomp-bpf allows for far more fine-grained rules for syscalls (like specifying that certain bits be cleared or certain arguments be equal to a value). And they're adding more and more features over time to it. I don't get why you would use ptrace (and if you don't use ptrace then you don't need another layer -- just play with the exising OCI support for seccomp and use runc directly).
>the drive to do the right thing independent from financial results is deeply ingrained in Google's culture.

That's the most highbrow way I've ever heard to describe googlers arguing internally about the day's hot button political issues while turning a blind eye to the ethical monsters in their own basement.
bfgvdcxfdfdfd
Looking for students to participate with with this service
Yes, this is the premise of domain fronting.
Memrise | London, UK | Software Engineer | ONSITE | VISA

Here at Memrise we’re building the world’s most joyful language learning app, and you could be a part of it! We already have over 32 million users, loads of accolades like Google Play App of the Year 2017 and Best of in 2016, and we have massive plans to scale and improve online and mobile learning for everyone.

Our backers include Matt Mullenweg (Wordpress founder), Jeff Hammerbacher (Facebook, Cloudera) and leading VC firms Balderton Capital and Avalon Ventures.

Currently we're looking for mid weight and senior engineering talent to join our cross functional squads. As a product driven business, our squads focus on 3 areas - Learning, Content & Growth - all of which currently have live vacancies.

Our tech stack is a mix of the following....
On our platform we use, among other things
Python 3
Django
Redis
Redshift
Lambda
Kubernetes
The frontend code is ES6 written in React/Redux

As you would expect from a language learning application, we are open to applicants from all technical languages. All we ask is that you have a passion for self improvement, and are open to learning a new language and frame work.

Check out our vacancies here - https://www.memrise.com/jobs/
It rewrites the syscalls to make them succeed: reading a privileged file? Rewrite to read a non-privileged shadow file. Killing a privileged process? Return success without killing anything, etc.

Whatever is not rewritten will fail in kernel: there is no security risk.
Nitro Pro 11 Crack with Serial Key Download Thatssoft.com
The Github page mentions that postgres, nginx and elasticsearch aren't currently supported by the gVisor kernel (or pseudo-kernel?). Those are significant, but they shouldn't be showstoppers for a lot of deployments. They list each of these shortcomings as bugs, so hopefully there's a real effort to support the capabilities required by those applications.

Also, I'd like to see what the performance impact is like. What types of applications would suffer the worst performance running on gVisor? What applications will be the least affected?
Yes! (I've edited my comment and added "and salt") and with a tiny bit of obscurity like a hashing algorithm that can't easily be calculated by a GPU or ASIC, then the hackers probably wont bother. Because scrypt is used by Litecoin, Dogecoin, et.al there are now ASIC's capable of billions of scrypt hashes per second.
I'm saying all solutions are a compromise.

(And you do need to memorize your password manager password - and your main email account password as well)

Also a lot of leaked passwords were strong, they just got compromised because someone didn't know about 70's password security basics.

Should we just never use any leaked password ever again? (Note I'm not saying: with the same login - or any of the "top 100") Should we really trust all of our passwords to one service that might get compromised or just go away?

Should we bother creating a strong unique password for that new cool SF startup that doesn't know how to use bcrypt?
Zuckerberg Risks a Night in U.K. Parliament’s Clock Tower
Vaposhop | Amsterdam, The Netherlands | Full Stack PHP Developer | ONSITE | https://www.vaposhop.com/

Vaposhop is looking for a Full Stack PHP hacker to help us develop our custom shopping software. We work in a small team, so you get to do a bit of everything. The job will involve mostly developing but also some server and network maintenance. You'll be working with PHP 7, MySQL, Linux, LXC, Ansible, etc.

-- Who we are --

VapoShop is an online vaporizer store with a distribution centre in Amsterdam. We have over eight years of experience in selling high quality vaporizers and are committed to carrying only the best home and portable vaporizers, including replacement parts and useful accessories.

You can contact us at: michele@vaposhop.com
Superfast file browser nnn v1.8 released with many new features
The corollary to the Peter Principle, I think, has always been that it's caused by bad management. Taking "is good at IC duties" as the measure for "should lead a team of ICs" is sloppy. You are not considering the person/what they're good at. You're just using an easy shortcut to reward them for their performance.

One problem is high-contributing ICs who think they should get promotions to manager. For whatever reason: it's how things are done, they really want to do it, etc. There needs to be a separate, equally status-conferring, career track for them if they're really not going to be good at managing people. They need to be convinced that the best thing for them is to stay where they are, being awesome. Which is probably hard. The idea that you are awesome, therefore you become a manager, get an office, etc. is pretty pervasive.

(The bonus would be that those of us who never, ever want to be managers no matter how much our directors want us to would have that career path available too.)
And leave them in a post-it glued to their monitor
What I've gathered about Graal is that once you have a compiler for the platform, Cross-Language communication on a hot path gets optimised to near-zero cost.
Well, GPUs expose the memory hierarchy to the programmer and have atrocious latency when hitting global memory with unordered memory access patterns. Your only chance to make a GPU outperform a CPU is to design your algorithm completely around memory usage. The difference between doing it right and wrong can be several orders of magnitude.

Even CPUs show huge performance gains when all the algorithm's data fits in the cache. This can easily be a factor 10 or more when you get it right.
No, the fact that Amazon owns the souq.com domain is irrelevant here.
I've checked dates before for a friend. Finding out before a date that they are fb friends with an ex is really useful
A Wayback Machine for Source Code
Cleverbase | Senior Backend Developer | Scala | The Hague, Netherlands | 32-40 hours| ONSITE | VISA

Who are we: Cleverbase provides a digital and secure way of identification, with the use of cryptography.

What: At Cleverbase we take on the ambitious project of designing and developing technical solutions for qualified information exchange. Our ambition is for end users to easily and securely exchange information, and to make it effortless to do business online with the help of our web- and mobile products.

You: As a Senior Backend developer you are knowledgeable about the current state of reactive programming and you are able to apply it to our software. An important aspect of your job is to continuously evaluate and improve our technical stack, including the frameworks and libraries. We work with Scala (Akka) because we value clean and functional code.

Benefits:
- A good salary that matches experience and responsibility
(32-40 hours / week)
- Work at a well-funded startup where we cooperating with big partners and companies
- A travel allowance and a premium-free pension
- 26 holiday days (based on a full-time job)
- Mac or Linux laptop

Full job opening: https://cleverbase.com/en/senior-backend-developer/
Contact details: beatrix.ten.bosch@cleverbase.com
Concur, my Outlook (2016/365) is currently using 250Mb. That's with 4 mailboxes open, and a heavy HTML email displayed in the reading pane.
Python programming language. Data Analytics is king in the business (and apparently political) world.
Why We Haven't Met Any Aliens
I wonder if it really clears 100% of your history. Will it delete all comments, posts, records of who you searched for. Probably not your friends.
Aside from the thought that a portion of these bad passwords may be for throwaway accounts, I think what we really need is a "Beyond Passwords" movement similar to the push for Let's Encrypt.

I use KeePass 2.x on my laptop and it's been great for having complex passwords, but the few seconds it consumes to load it up every time just to log into a site is annoying. Worth the trade off, of course, but can't we do better?

Browsers, operating systems, and sites need to cooperate on making password managers as low-friction as possible. Once that's done, it's time to explore other options for users, like dongles (Yubikey?) or those "no password login" mechanisms like what Mozilla was running with Persona. Sad they discontinued that.
Memory Instrumentation in Erlang OTP 21
They didn’t wait until the final few paragraphs to build this up as a gender/race conflict.

“In 2018, skateboarding is going through a similar change from the inside out. There’s increasingly less space between what skateboarding actually is and what a bunch of middle-aged men perceive it to be. That wave of change is best represented by the breakout success of Nora Vasconcellos.”

I’d argue the “white” in “middle-aged men” is implicit.
Right now the absolute calibration is done by matching nearby supernovae with Cepheids and then extrapolating to remote SNs which is where the cosmology lies (essentially).

Gaia gives better Cepheid distances, decreasing the total uncertainty somewhat. But the big story is the calibration of the intrinsics supernova brightness (and its variation), so while better Cepheids help, its mostly by further closing a already unlikely avenue of explanation.

The big crime of the article is portraying the field as thinking the tension is due to new physics, when in fact the difference between the CMB and SN determinations has been known for something like 20 years and for all that time been mostly viewed as something experimentalists get sorted. For a long time the values agreed within their stated uncertainties, and its only rather recently that they have pushed their statistical errors down enough that the difference can be said to be real. So its a while yet until the difference is truly trusted as something to be explained by new physics rather than some calibration error.