skysight-inc/HackerNews huggingface dataset:
I don't understand why it's not possible to make /dev/random block until there is enough entropy in the pool for the seed, and never block afterwards when it can securely do key-stretching.

After seeding, there is no point in blocking on a lack of entropy, which is why it is recommended to use /dev/urandom in the first place.
I'll be live-blogging a new web/app build for the next 10 days
Hey everyone. I've taken the plunge and today I start work on developing a new product (web/app based).

To make it interesting I'll be live blogging everything I do, so I hope you guys and gals will find that interesting!

Start the journey with me here: https://twitter.com/chatWithMug
Ask yourself why more people don't use Qt:

(1) With web technologies you can write once and run everywhere including mobile to some extent. Writing a UI multiple times is monumentally expensive. Even huge companies don't like to do this, let alone indie efforts and startups. If Slack with its billion dollars doesn't do it what does that say?

(2) The ecosystem is far more active. The web is the largest open source ecosystem in history. There is code to do literally everything and an embarrassment of riches when it comes to libraries, frameworks, connectors, etc.

(3) Qt isn't that much less bloated than Electron, especially when you start styling it and get dynamic.

(4) Long build times mean that I have to wait a lot longer between dev/test. UI development tends to be a whole lot of iterative hack-test-hack-test. With web tech it's literally edit-refresh, which is much faster than edit-make-wait-launch.

(5) To make Qt look good you have to start styling and using its weird surprisingly web-like stylesheets, which takes you out of pure native mode and into a hybrid rendering mode. At that point I'm halfway to browser rendering.

(6) If you code UIs with web tech you also get the web, meaning your app could be run remotely in a browser as well as locally. This is the networked app promise of X11, Citrix, etc., and you get it for free.

Electron is popular because it delivers a ton of value in terms of cross-platform compatibility, reduced effort, rapid development, consistency, and ecosystem. Performance and memory use problems can be fixed.

I have been watching this project:

https://github.com/andlabs/libui

It's a genuinely lightweight wrapper that looks really promising. Trouble is everyone I show it to says "ugly" as their first comment. Everyone wants styled apps today with polished UIs and that takes you down a path that looks increasingly like CSS whether you like it or not. I also have this strong feeling that if I wrote with it I'd be rewriting in 5 years after desktop UIs are abandoned in favor of 100% web technology everywhere. Of course web UIs shift a lot too. Maybe the fate with UIs is to rewrite every 5 years no matter what.
Not exactly sure what I just read. A list of statements without any real arguments or insight in why they are the best practices.

I think it is very hard to have such a list without over-generalizing or writing a book.

The piece could use some rework. The idea is nice, a series on best practices, but the execution needs to be looked at.

P.s. AWS has a whitepaper on the subject which is an OK read for starters in the area. I would redirect any reader of this post to the collection of whitepapers by Amazon. They also have the same for security. They cover the basics.

[0] https://aws.amazon.com/whitepapers/architecting-for-the-aws-...
My preference is for long passwords that comprise a natural language sentence. They are easy to remember and hard to brute force once they are greater than 40 characters. You don't need any of these draconian password rules if the password is long enough.
Also, what is the context of the hacking?

Copying of intellectual property, or hijacking CPU/GPU cycles for crypto mining?
Not true. Look at the various Skype clients, e.g. for Linux. Memory usage ballooned after they wrote their Electron based client. It uses 4 to 5 times the amount of memory of the old Qt based client and idle CPU usage is through the roof, too. And it can't even handle long conversations smoothly.
>Well, the existence of Docker and K8s do.

The fact that Docker and K8s are written in Go, doesn't provide anything for anyone considering to writing new container projects...
Are you sure that it is Prince powering this?
Facebook denied a stay to Schrems II privacy referral
No problem? They crippled their own use of the internet, at huge financial cost.
The depressing thing is that every new company I join has terrible password hygiene: shared accounts (even on services that don't force it), passwords reused on multiple services, terrible passwords, passwords emailed around, passwords in word docs that are emailed around ...

If IT people can't get this right, it's impossible for the average person to EVER get this right. We need a better solution.
GDPR: what it is and what you should be doing to prepare
That is correct but it's a slightly different threat model that I don't want to tackle here.

I'm not going to make claims that a developer would maliciously embed code into their own product but I do care about the quality of their code and their security practices at large (specifically how secure is their code promotion and binary distribution supply chain).
I use keypassx on Mac, Windows, and Android. It is a minor pain to have to log into it to grab my username and password, but worth it. I sync the encrypted DB with Dropbox.
The first screen "wtf" has no meaning for me, I almost closed the browser immediately. After scrolling to the next screen it makes much more sense.
It was their punchcard technology, which is more akin to databases than calculators.
I feel we're talking past each other because of a spatial analogy.

My point is - by employing domain fronting against censorship, you bet that the adversary will not ban the service you're using as a front. But they very well might just do that. At this point, everyone else using the service suffers. So that service, by refusing to be used as a domain front, is not just protecting its own interest - it's protecting interests of all the others who depend on it. You, on the other hand, are unilaterally putting those other people at risk. This does not make you a hero, it makes you a villain (even if a lesser one).
That is why we are here, and the 'other' is not. Hegemony exists.
The general idea is that because is already a grid you don't need another grid. The point of this project is not to make just another grid, but to make reusable system using the same CSS classes in your entire project.

P.S Yes, using fr is good idea..
Are you posting on Hacker News from your own IP address?!?! :-O
>I don't believe that Go or Swift are growing because of their technical merits. Swift is essentially forced by Apple upon any developer who needs to develop applications that run on Apple products

It's also a very good language, in par with Rust, and with the creator of LLVM behind it, and the creator of Rust (and many other Rust people) working at Apple in Swift.

>Go, in spite of its pedigree, can't be sold to newcomers without waving the Google brand.

And yet, Dart never got anywhere, despite the "Google brand" (and far more support initially, including official branding, an IDE, and having their #1 compiler guy working on it).
I want to check this out but I'm on my phone so there's no way to "view source" and see how to actually use the framework. All I can see is the resulting grid on the demo page. Maybe add code snippets?
It’s not really responsive, it just stacks grid elements vertically when the viewport width is < 480px.

https://github.com/vladocar/SMART-CSS-GRID/blob/a0cfd2c730e9...
Actually, that was just from just loading Gmail and letting it idle, a couple of weeks back, not actually using it. A year and a half ago, I recall it being more like 125MB, up towards 150MB as it was used. Gmail hasn’t really changed since then, but the Hangouts widget (which is pretty heavy!) might have, and the browser definitely has (I blame it for most of the increase). I haven’t actually used Gmail since around that time.

For reference, I’m using the explicit/window-objects/top(…) figure from about:memory. This is not an accurate representation of the full footprint, but is close enough.
Ask HN: What's an engaging, interesting framework/tool/topic to learn?
Good morning HN! I am searching for new topcis which are both fun to learn about and have practical applications. Current areas of i interested are x86 ASM, graphics programming, low-level optimization/unerstanding, physics, databases, and creating web applications.

What language/framework/tool/process/idea have you learned that really grabbed your attention and made you excited for its real world applications? Thanks!
'Security' is some kind of religion in tech circles. I don't know if it is just that risk analysis isn't part of your standard tech education, or if they think it makes them look cool to talk about always using 200 character hardware-RNG generated passphrases when ordering pizza online, or what exactly, but they're everywhere.
Mark Zuckerberg says a legal provision allowed Facebook’s rise
Can you give an example of a site that couldn't be moved to HTTPS? I would expect that even if the serving stack doesn't support HTTPS you could put a proxy in front of it.
That seems intuitive but is surprisingly misguided; in fact, it depends on your purpose.

Consider planned destructive testing in engineering, where perhaps one component is built purposefully weakened and then the whole system stressed in order to ascertain where and how the other components fail in response. This can lead to better understanding and to superior alternative designs in future.

In a related way, we can imagine destructive testing on facets of our institutions and societies, and try to ascertain how our systems may then fail in turn.

One example is when designing constitutional separation of powers, we might find it implausible to imagine a president intentionally undermining the Justice Department and his own intelligence agencies, but yet still design the constitutional separation of powers in such a way that the system retains some amount of robustness or integrity should that ever eventuate.

We might choose to design our medical quarantine protocols in such a way that they don't overly rely on protecting against known agents (viruses, bacteria, fungi, parasites, amoebae etc) but have some robustness against not yet encountered classes of threat, eg quarantine protocols that were concieved before the discovery of prion diseases.
SEEKING FREELANCER, Cleveland, OH, Remote OK

We are looking for a developer with experience building web applications with Wordpress. This is much less of a frontend/theming project and is more about customizing and adding functionality to Wordpress to improve our customer experience and make our backoffice more efficient. We need someone who has experience building and extending plugins and experience building on top of WooCommerce and WooCommerce Subscriptions is preferred.

Email: scott.sharp <at> sprinly.com
As for the safety, I guess it rewrite syscalls that would otherwise fail for lack of privileges.

In a way, they have made an advanced version of the old fakeroot (a LD_PRELOAD magic thing--thus very limited in scope.)
Better when discussing logistics, at least. :)

Saucepans aren't flat, but they rarely go on airplanes.
What about putting somebody in prison for more than 5 years because they made copies of DVDs and printed a Windows and Dell logo on the DVD?
vcxzcx
I played a MUD that had a distance system, and even some of the devices had longer distance than others.

What would happen would be that people would just communicate as best they could, and occasionally ask people to rely what they were saying in a general direction.

Of course, with a very limited world and a communication range of about 1/4 of the north-south distance of that world, relaying was pretty easy.

There were other in-game ways to send and receive messages, but none were nearly as convenient as this one. The real world, however, has plenty of convenient communication methods.
Show HN: Sweeten Your Promise with Monadic Syntax in ReasonML
If it's not safe then it wouldn't be a proper sandbox I'm the first place.
The goal is to intercept all system calls and reimplement them in a lightweight kernel that talks with the host kernel only via a minimal 9p based protocol.

I.e. there is never a direct syscall being served by the host kernel on behalf of a process running inside the container.

From what I can read in their design docs, the user id running inside the container seems completely irrelevant.
I have 118 entries (which seems scary) and a quick scan shows me about 95% are not rubbish (I guess there is a selection process) and something like 2/3rds I have some kind of financial relationship (HMRC/VAT, paypal, phone provider) as well as a (small) number of stores (I think Jeff Bezos needs to be thanked for that)

Overall I am surprised - I would be prepared to use 2FA for quite a lot of those (many I do).

And if those sites mostly moved over to using OAuth with Google or a more privacy minded provider, yeah I would be fairly happy.

In fact why does Apple not do OAuth2? They have the privacy-is-our-thing going for them (as opposed to Google / Facebook whose business model is selling my data).

After that I guess its the UK government Gov.Verify for commercial users
A layman’s guide to Attribution Models
A redundant water main was built in the 90s partly so the one in the tunnel could be quickly removed if needed.

The new one was built as part of the Fort Washington Way rebuild.
100% agree with this - it's one of the main reasons (other than ad payouts) why they're not massively competing with YouTube just yet. News Feed is their core, but it's also what's been holding them back from really destroying other markets - the discoverability mechanics (you never know what's coming up, so keep scrolling...) of the News Feed are a blessing and a curse.

When they break themselves away from this (which they arguably have with their attempts to embed more in Messenger - I can foresee a future test being you subscribing to video channels/news brands in Messenger and having bots push the latest vids out, history repeats itself), and open up a few more interaction mechanics, things could change.
I personally prefer _not_ integrating my password manager with my browser, even though the option is available. Instead my password manager performs manually-activated autotyping which, while less convenient, does at least 'feel' like it's more secure.

I trust my OS to isolate applications from eachother more than I trust my browser to isolate extensions from the page they run on. LastPass in particular have had their browser extension exploited[0].

[0]: https://blog.lastpass.com/2017/03/security-update-for-the-la...
GCC 8 Release: Changes, New Features and Fixes
Pinga | Lead iOS developer (Swift) | London | Full Time | ONSITE | www.pinga.co.uk

We are changing communities so it becomes more normal to help people around you. Our app let's you crowdsource a community runner to get what you need from nearby shop, cafe or person very quickly.

Are you our first in-house iOS engineer? We're expanding our operation and launching in London this Summer. We want to develop our existing code, but then are open to entirely re-architecting the app over the coming months.

We're looking for an experienced Swift developer, and can also pay more for a full-stack engineer with PHP experience. Someone who really backs our vision to expand to all urban areas worldwide.

We work out of a cool office overlooking the Thames with beer on tap and genuinely good coffee.

Contact Mike (Co-Founder) at michael@pinga.co.uk
IMO this doesn't have to be controversial to each other. I am software dev as well, however I call friends or even just drive by, I shop most things in actual stores (except things I have to import because my market is rather small and limited), I never gamed, never owned a TV (I do enjoy some series tho), ride my bike everywhere and love to meet people on the way. Hence I even visit (or call if anywhere else) my bank once a month instead of online banking.

I love creating Technologie that contributes to my way of life instead of making me more isolated.
Did you have to spend more than 2 years incarcerated?
GCC float comparison: since C doesn't have a portable way to denote single precision float constants, it's a good idea to cast them in order to avoid implementation specific differences. See: https://godbolt.org/g/t7UYoi

int
float_compare(void)
{
float x = 1.3f;
return x == (float) 1.3f;
}

This correctly returns 1 on all compilers I cared to check.

Couldn't reproduce clang calloc removal bug with that code. Tried clang 6.0, -O1, -O3.

Clang did remove calloc when there were no new_image calls where parameter "shade" could be zero. But that's to be expected, as it is a static function, only accessible from same compilation unit. Entirely correct behavior.

https://godbolt.org/g/FfV7G2

When it comes to the filed clang bug, I fail to see any bug at all: https://bugs.llvm.org/show_bug.cgi?id=37304

When calloc return value is not stored (or used), how could it be accessed or even freed at all? I think compiler is right to remove whole call.
CSS Grid is a newer concept than Flexbox, and solves a different problem.

https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Grid_La...
Or by disabling automated entry, or with disabling the password field until the username field is filled.
I've been working remote for over ten years now and I've never had a hard time finding work. I've never had to work for a subpar salary because of my reduced cost-of-living. Being experienced helps but ultimately it's about delivering results.
+1 for videostream, it's an amazing app that I use almost daily. I paid for the premium version (playlists, download notifications etc) and it's well worth it.
Same here. It didn't ask me for any location permission either, so I don't know how it would know where I am.
Amazing how Dell is phasing in the new port, rather than just replacing all of the old ports with the new (immature) standard.
Perhaps draw a Voronoi diagram of pubs in the UK and use that?
The mistake here is that they are not guerrillas and are not hurting anyone. It's censors that do. It's collateral damage only from the point of view of censors.
before I got into a password manager, I resorted to song lyrics, capitalizing the first character, including a number and a symbol at the start.

'#1I'm picking up good vibrations', for instance.
The default of the system is less then 480px for some reason Safari doesn't resize try Chrome or Firefox..
6 Βήματα για πετυχημένο σχεδιασμό ιστοσελίδας – WEB DESIGN|SEO|PARAMARKETING.GR
"Putting them at risk" not by doing anything to them, but by being near them.

The domain fronting could be set up in a way that doesn't spoof domains, and the risks would be exactly the same. The spoofing is a red herring. The issue is the mere idea that a censor would be unable to tell what domain a connection is for. The actual thing that puts people at risk is ridiculous to attack on a moral basis. It's the same as just existing in a crowd. Not grabbing someone to be your shield.
> We can leave the remaining ~3,500 species of mosquitos—which don’t bite humans—alone.

Runner here. No thanks. I would like to run in peace.
Good thing this is hacker news, or I might have missed out on a barely-relevant pile-on of commenters letting me know how terrible Electron is!
Clearly. Can we name the real DNS owner? It changed hands kinda recently...
I wonder how this is similar or different to FreeBSD jail; which has existed for the past 13+ years.

https://www.freebsd.org/cgi/man.cgi?query=jail&apropos=0&sek...
Learning RapidMiner Livestream Volume 1
Lord, that is the truth..
and I think this is a large part of 'ageism'.
Sure, and that's why salted hashes are a thing.
Not taught since fall 2016. Was taught by some passionate students it looks like.

Only current one I could find is
https://www.mccormick.northwestern.edu/eecs/courses/descript...
1st/2nd semester stuff, but requesting a CS degree or equivalent qualification is against the SJW agenda.
Yes but unless they both are in same room. Imagine a soccer match or any tech event. These are some use cases I thought of while building this.
Soccer Jerseys with 50% discounts
For once the Twitter comments are actually good. A gif of the merge sort and another giving its big-O rating.
This riles me up so I will rant.

I've given up remembering passwords for important accounts and just use the 'forgot me password' button to auth through email.

If your site or service doesn't have more than 100 million users, please don't require a password for my email. Let me log in with another trusted account (Google, Twitter, etc). I miss the days of oauth2 and the flexibility of authenticating small services.
And a web app runs on a local server, so where is the problem?
On my linux "Apps" run on (X) server too.
Actually I was searching for Terms of Service and Acceptable usage policy for .app domains and could find NOTHING specific. Not even on official site https://get.app/

I could only find Google Terms of Services, so they also apply to .app ??? So what if I host e.g. adult related material on .app will they ban me? The usage policy is totally in the dark for this domain.

UPDATE: Found something here https://v4.gandi.net/static/contracts/en/app/pdf/special_con... and here https://portal.icann.org/servlet/servlet.FileDownload?file=0...
बावली तरेड़ # Ep- 01 #Brand New Haryanvi Comedy Webseries #Deepak Mor#Comedy2018
A tad off topic, which password manager would you recommend?
AMBOSS (US: amboss.com/us, DE: amboss.com/de) | Berlin, Germany; Cologne, Germany | Full-time, REMOTE, VISA | https://www.miamed.de/jobs

AMBOSS is a revolutionary new learning system for medical students and physicians. Our team consists of more than 100 dedicated physicians who are driven by the idea of improving medical care for people around the world. Do you want to participate in shaping a new era of medical education? Currently looking for:

- DevOps Engineer (https://www.miamed.de/jobs?gh_jid=1018195)

What we offer:

- Diverse and interesting tasks with a high degree of autonomy

- Ambitious and dynamic team with flat hierarchy

- Extensive mutual support in a versatile developer team

- Lively start-up with a trusting and friendly atmosphere

- Flexible hours. Offices in Cologne and Berlin

- Regular team building events

- Contribute to a product that can actively and positively change the world

- Apart from an almost Barista-grade espresso machine, we also have a custom-made Argentinian barbecue on our rooftop terrace and a fridge that’s fully stocked at all times
Nonsens. Every traffic can be monitored, web app or native app, that is not important.
> "I guess it rewrite syscalls that would otherwise fail for lack of privileges"

That's not how access control works (on most systems). The system calls are still issued from a single process. If the gVisor process is running in the context of a non-privileged user, the system calls will fail regardless of the codepath.
Wow, indeed! That outlier at the 5-ish% sales mark needs more study.
> I'll never forget the moment when he introduced the S and K combinators - been fascinated with those ever since.

Rabbit hole warning. If you go down this particular hole you will lose at least a month and maybe more. It will be the most fun you've had in a long time but your productivity will take an extreme hit.
Something like http://lambdaway.free.fr/workshop/?view=NIL
Why do you spent 2 year of your live to build a new email client? Aren't there quite software per this scope?
Try this : impractical jokers the best I've come across.
In the attached video to the page one of the promoters himself says he gets around £250 for each episode. So not 5 or 6 digits.
yes, there are many domains which describe what is acceptable and what not on their usage policy or terms.