skysight-inc/HackerNews huggingface dataset:
TLDR: Ivan, thank you for everything you've provided to the IT community.

- - - -

There's few people I am more pleased to see commenting here on a topic like Sec more than yourself Ivan, your work's exceptional. And the tools you've provided like Hardenize and SSL Labs have saved me countless hours.

Your books have been an immense source of knowledge for me (and I'm relatively a newcomer by my colleagues standards).

Really pleased to see you here on HN. Though, I'm not entirely surprised. The best of the best seem to haunt this place.
I believe so, in this baseline implementation. In fact, that's also true of operations on doubles (non-Smi) in unoptimized code, which are stored as "heap numbers". Avoiding these allocations is one of the things an optimizing compiler can do (and does do, for doubles).

That said, for short-lived BigInts, the allocations may not be as expensive as you might think, since the garbage collector is generational and short-lived objects won't leave the nursery.
Visual Studio 2017 version 15.7 and version 15.8 Preview 1
I couldn't read to the end of that article, I just felt myself dying inside.
Nobody said "don't put up a firewall". By all means, set up the rules on your VPC so that only 80/443 hits your ALB and nothing else is routable. But don't futz with iptables on your hosts or god help you setting up a separate AMI for some 3rd party firewall.
Tesla doesn't build self driving cars. They have a very fancy adaptive cruise control and lane assist. Tesla's don't have LIDAR. They cannot see stationary objects on the road. They are also prone to killing the driver but usually nobody else. There is also no potential for improvement without hardware upgrades.

Sure. Uber's cars have been involved in a deadly collision but they don't suffer from the same problems as Tesla. The primary problem with Uber is that the company is acting recklessly to gain a competitive advantage. If they had multiple fail safe mechanisms then accidents like this could be prevented.
for us colourblinds, North America, South America, Australia and Greenland are one group. But I assume they are not.
A more more direct anecdote: I just got a replacement social security card by mail. All it took to do it online was information from my credit report.

Thanks to this breach, the only defense against someone getting my social security card fraudulently is that it has to be mailed to my current address.
Does the diversity of thought include things that are false?

Like if we teach people that the solar system is heliocentric, but someone wants it to be geocentric, is that the kind of diversity of thought we want?
It irks me how he doesn’t credit XKCD directly in the tweet.
Interesting! I don't immediately perceive anything distinctly American about it, but I'm definitely biased. Could you provide any examples of what you'd consider non-american data design, if only for my personal design curiosity. :)
A good discussion not long ago, https://news.ycombinator.com/item?id=15074144
I know of these projects and some of my friends are investing and/or building them. I commend the ambition and really hope they one day turn into something great.

That's beside the point, though. Knowing that Ethereum and Bitcoin consume more energy than Iceland and Switzerland respectively, why don't we turn them off until they're providing actual use? I get that markets need time to figure out if a product is useful and useless things get built all the time, but has that discovery process ever been done at this scale before? For instance, if proof-of-work ends up spending as much electricity as the United States and we still can't use it for anything meaningful, shouldn't we be concerned? I know "turn them off" sounds silly, but you can tax the miners or impose energy consumption caps until there is a smart contract out there that is arguably benefiting society.

If concern for humanity's wellbeing on this earth is a "throw away" concern to you, then maybe you can provide an argument for why everything's going to be OK? Have we fixed global warming and I just didn't get the memo?
Sure, but this is only possible if the original (shared) gene was really quite close to being able to transport oxygen.
I like that he offers solutions but honestly, more people are vision impaired than have javascript disabled so instead of doing all that work instead put it first on helping people with disabilities.

> There is a danger that more and more sites will require JavaScript to render any content at all.
What danger, exactly? While some sites that don't require a lot of js is nice you will soon notice that many sites you want js on. Music streaming services is one example.

I build api based sites nowdays because of mainly two reasons:

1. They feel more rapid after initial load and gives the user a better experience.

2. You can use the same api for web and mobile experiences.

I personally think that WebAssembly is the future so the web will finally just be another compilation target and I can't wait for it to be wide spread.
http://www.designishistory.com/1960/first-things-first/
They are all the same color of green.
How to Get Remote Teams to High Perform
I think that may have the opposite effect. If consumers are willing to spend less, then the practices used to produce those things are necessarily going to need to be cheaper. This means that they will use dirtier means as a necessity.
How to Inspire Your Team to Achieve More
No it isn't equivalent to all other pipes in terms of capacity and robustness. It is equivalent to the COMMON pipe today, but you still have to watch because some applications use the same thread/outside diameter but the walls are thicker. Also there are still some old pipes out there that really do have the 1/2 inch inside diameter, they are equivalent in terms of robustness, but obviously not capacity.

Of course I'm being pedantic - in reality you will probably never encounter the exceptions.
>focus on removing attack surface, rather than continuously monitoring it.

Amen to that. I stopped caring about these sorts of entries in my HTTP logs when I realized these automated attacks target software packages written for language runtimes I don't even have installed. I'm sure not losing any sleep at night that someone is trying to hit phpMyAdmin or wp-admin on my server that doesn't even have a PHP interpreter.
> But why would anyone ever choose bad outcomes?

Because what they want doesn't correlate with what's in demand at that point in time?

I mean, someone might want to study English Literature at degree level, then find a job based on those skills. However, if those skills weren't in demand at that point (because everyone wanted people with STEM degrees or programmers or what not), then their outcome would likely be worse than someone who studied computer science.

Did both of these people have equal opportunities? Sure, they could have both gone into one field or another (assuming a theoretical situation where their intelligence was roughly equal and the degrees cost about the same). But they didn't, and their outcomes weren't equal. That's not necessarily a bad thing, and one choice wasn't necessarily 'suboptimal' either.

And how about a few others?

Someone going to one city over another is a choice, and the consequences could be very different based on that choice. That doesn't mean there necesarily wasn't equality of opportunity.

Same for things like what job you choose (assuming they're 'equal' on a technical level), who your friends are, what hobbies you have, etc. You can probably think of thousands of examples where people are making choices that lead to inequal outcomes, simply because either the market demand is different, attitudes are different or random factors in the world are different between them.

Choices don't necessarily have to be 'suboptimal' to have different outcomes.
Robertson has a really nice taper that makes one handed operation really easy even when the screw metal isn't magnetic. The large size of the recess also means you can work Robertson screws even after they have been painted or varnished over. Robertson sizing is also incredibly simple so you grab the right tool every time. Each size has a colour name so you can easily call out each size to a tool fetching assistant (always my role as a kid) and there is no ambiguity if the screwdriver is the right size or not.

Not a ton of advantages over Torx for initial assembly, but if you ever need to repair, especially someone else's work, Robertson is second to none.
Large scale Twitter bot farm targeting Londoners
If you really want to feel guilty about buying an iPhone or an electronic product- you should look into cobalt mining in the Congo. The Democratic Republic of Congo is believed to have half the world's supply of cobalt and two thirds of the world's cobalt supply originate from here. The price of cobalt has doubled in the past year yet children are still part of their cobalt mining process... [1]

Are you guilty that Apple or other big tech companies allow a child to mine for your tech products?

Or is this a problem that big companies would have better power to fix than you?

On the other hand, I think Apple is buying their own cobalt mines so hopefully, your Apple products are or will be child labor free... [2]

[1] https://www.cbsnews.com/news/cobalt-children-mining-democrat...

[2] https://www.bloomberg.com/news/articles/2018-02-21/apple-is-...
Ribbon map of the Mississippi River (late 1860s)
In an ideal world, literally no SSH at all. That's doable in container cattle fleet networks.

In a realistically achievable world for virtually every startup, no routable SSH. No security rule allows 22/tcp from a routable address into a VPC. You want to SSH into a host, you VPN to your network first. This is how most organizations with security teams set up SSH.

If you can't get there, at least get to jump box SSH --- 22/tcp is allowed to exactly one isolated host from the outside world (some people filter source addresses to their jump boxes, I don't bother); to get to real hosts, you bounce through that one.

A network where you can randomly connect to the sshd on real servers is one most security professionals will assume isn't being run competently.
There are plenty of legitimate use cases - calendar apps, issue trackers, online games, news sites.

They just tend to be stupidly implemented. If I'm a first-time visitor to your news site, and I haven't even read the article yet, there's about a 0.00% chance I'll allow notifications. Why they don't set a cookie and prompt only once you're a repeat visitor for a while is beyond me.
Something out of pwgen or diceware would do though.
If your application has length requirements that preclude the latter, make sure they are liable if you loose something due to preventing you from using a secure password. (No one can remember a short secure Password for more than a small handful of applications.)
As a chef, these are the sort of preferences we in general have as well.

My current menu is 4 entrees, 4 mains and 4 desserts(lunch changes weekly), same for dinner.

The slight variations we have are gastronomic menu (a small portion of each dish), a plates menu (set courses) or a standard pick what you want to order and pay for a full sized your probably useto.

Edit to add:

This is so that we can concentrate on the meal. Each section only creates 8 actual dishes(for lunch), 4 are off the dinner menu and are quite rare to see ordered (due to cost difference from lunch), but those 4 lunch menu items I can spend a lot of time focusing on. Yes I might send 50-100 meals in one service, but if they are the same 4, I can create something of very high quality and consistent across the entire service.
This looks similar to CADF [1], which is used by OpenStack, but it looks less structured.

In CADF, each event has a target (the thing that is changed or being viewed), an initiator (the user performing that action), and possibly an observer and reporters. I'm not sure if CloudEvents wants to be intentionally minimal, or if it just hasn't developed to the same intricacy as CADF (as the 0.1 version number suggests).

[1] https://www.dmtf.org/standards/cadf

Context: I work on an internal OpenStack deployment at SAP that uses CADF for auditing.
"Defense in depth" is just a way security product salespeople get customers to buy more stuff. If you remove attack surface altogether, you don't need more depth of defense.
Real Time Human Pose Estimation in the Browser with Tensorflow JS
You could say that's why web won.
OP should ask (and perhaps share with us) why the native widgets are important, genuinely interested!
Like others have said, the GPL isn't a problem if you're hosting a web application. The AGPL (Affero GPL) is what would affect that.
While I am not a fan, I see this a "potential" win for those running Office on Macs.
> a little humor can make it much less laborious

Here, here!

I would even go so far as to say that Why's (Poignant) Guide to Ruby directly contributed a great deal to Ruby's popularity because of the witty content alone.
I haven't worked with automotive radars but the way it works in aeronautical radar is that you apply frequency binning in the electronics and ignore returns that have the wrong Doppler shift at the waveform level, long before step A in the article. If you didn't do it this way your computer would be overwhelmed considering every tree and house you can see but only moving objects like airplanes.

It's the same principle as the way your eyes only report things that move over your retina as your eye moves, letting you filter out imperfections in the lens of your eye and your blind spot.

Similarly, I assume that the computers in a car would be overwhelmed by the task of taking the returns from every single post on a guardrail and sorting them into distinct objects before deciding to ignore them due to relative velocity so I'm fairly sure that a similar mechanism is at work within the hardware of the radar unit the Uber car.

So given that the woman showed up on Uber's sensors she would have been detected by the camera system or the lidar. And apparently she was detected.
Minor nitpick which I can't let go because it's been on my brain lately:

VC is not always equity, especially in the early stages of a company. Convertible notes are debt instruments (and SAFEs are warrants).

They convert to equity eventually, so you are of course correct in the long run (and why it's a nitpick).

But until that happens your investors are debt holders.
I think it's important to distinguish between limitations on power imposed after the fact, and limitations on power that prevent one from exercising their power. CEOs are not dictators in that they answer to a board, shareholders and, ultimately, the law. But those limits tend not to prevent CEOs from exercising their power, but are rather consequences of exercising their power. On a particular day, when CEOs say something should be done (such as firing a particular person or saying something publicly) it tends to happen.

Whether or not we call a CEO a "dictator" is perhaps a distraction - although I think the word usually fits in the colloquial way people tend to use it. The important thing, I think, is the recognition that CEOs orders tend to be followed, sometimes even against the desires of people executing those orders. The controls placed on CEO's power tend to be consequences rather than immediate limitations.
Http 418 “I`m a teapot” status code
Security through inconvenience?
Install uBlock Origin and do it every day!

I block all JavaScript, then re enable it when needed to fix a site.

Often I just need to enable 1st party scripts in the uBlock Origin grid to fix it.

Make sure you enable advanced mode to see the grid.
Sinatra's website SSL Certificate is expired
Which is in fact the most used, and arguably technically superior to glibc.

freebsd -> darwin, openbsd, netbsd and dragonfly bsd.
openbsd and netbsd like to add their own stuff on top of it also.

The Open Watcom libc and bionic are also superior. bionic is getting better and better recently.

musl is in some parts better, in some parts worse.
Same for Embarcadero C++ libc.

Worse than glibc are only: the two MS libc's, msvcrt and ulibc (which is getting on par), the wine libc, newlib (arguably with dietlibc the worst), uClibc, minilibc.
The relentless honesty of Ludwig Wittgenstein
I love examples of laws like this which, while well intentioned, actually do harm to their own objective.
Very true. Write a book or speak at some conferences and you are suddenly much more worth.
It's designed for a very different use case, where power is a primary concern.

Not so if the same CPU and stuff were jammed into a car (under condition that the heat is taken care of so it doesn't throttle itself).
How to create custom list views
If they are US citizens then whichever way you would pay the non-remote probably. If they aren't, then they will tell you which is best for their situation/country according to what's available there and the lowest fees.
Space invaders on EOS blockchain with 500ms latency
green just mean newly created account

I also find that colorscheme plainly confusing, maybe a tooltip or something to explain the color will help?
Join a Decentralized Venture Studio / Co-Op
I'm putting together a co-op of developers to start a decentralized venture studio where we build, launch, and own the companies we create.

The concept is like a supergroup or a band with rotating members.

We're hoping to get the initial group finalized in the next week, and are going to vote on an idea to build as the first project in two weeks.

My hope is that this structure will better represent the value contributed by the individual as it's pretty well understood that employees tend to be the first to get screwed when a company sells.

If you're interested I'd love to speak with you about joining. It is, of course, free to join.

you can find out more at

http://kaiya.io

or join our telegram

https://t.me/joinchat/AAAAAErKJlcRvbOC_iGozg

Thanks!

AP
Could you please contact me by going to my profile page?
My, that's nifty! Sad I've overlooked it, happy that it exists.
There should be plenty of options now. If you're in the US, Coinbase I heard is a good option. If you're in Europe, go for Bitstamp / Kraken.

Honestly if you don't buy a huge amount of Bitcoin, the exchange is just fine, since you can trade readily without much hassle. It's always good to have your own secure offline wallet though.
I really hope you aren't the author of NGBook - genuinely one of the biggest over-hyped pieces of shit I have ever had the displeasure of reading a chapter in.
Uber Self-Driving Car Detected Pedestrian but Decieded It Didn’t Need to Stop
This is a dark day
Uber Crash: Self-Driving Car Saw but Ignored Woman in Arizona
The biggest take away (no pun intended) I got from this article is that the owner was cluless and the chef was non existent.

Where I come from, the chef designs, costs and impliments the menu. If I, or the theorical they, don't draw customers or sufficient funds to cover the business they are out on their arse.

For a chain, there needs to be an executive chef whose sole job is to cost, oversee each location, ensure quality standards are being kept, use the fact that the restaurant is order x amount more than anyone else to get a better price from suppliers and make sure everything is running at cost (our next cinname in the industry is bean counters for a reason haha).

This sounds to me like the owner got in way over their head.
I'm also a user of FastMail, and the thing is, I always struggled with this gmail "feature".

I want to be able to organise my emails as I want, and FastMail gives me exactly that.

I use a different username for each and every service, while keeping my domain as same, so I receive all emails to this domain and sort them as I want.
We’re Running Web 2018 with Web 2008 Dashboards. And That’s a Problem
I think voting this down is unfair. That's the first thing I thought of when they mentioned "bank balance." Well, then there's credentials. Now it's complicated, and complicated and Javascript are a recipe for disaster.
Yes. The arguments for geocentricism should be published as should do the ones for heliocentrism.
That's...very different from making a promise, though.
Will need to look at that! I've disabled JS ever since the spectre/meltdown CVE announcement and only enabled it for a select few sites. Now if I hit a SPA site I just close the browser tab unless it's something I really need and want. It's ludicrous how many "doc" and "brochure" sites aren't functional w/out JS enabled.
How to Write Personalities for the AI Around Us
i do it every day
First-quarter global gold demand drops to lowest in a decade
Renewable energy like solar are getting more cost efficient. One report says that renewable energy will be consistently cheaper than fossil fuels by 2020.

https://www.forbes.com/sites/dominicdudley/2018/01/13/renewa...
I work as an independent consultant and one of my recent projects was a study on the fast-casual restaurant industry on behalf of a long/short investor. It's a fascinating industry, and a bit depressing to learn about in depth (kind of like reading this article).

The basic business model of all franchised restaurants with fixed menus and nationalized marketing budgets is getting people in the doors with something appealing (e.g. a value meal) and then get them to buy high-margin products (i.e. coffee, soft drinks, french fries, and food items that don't contain vegetables or meat).

One thing I think most people don't realize is how much the house loses money when you go in there and buy the healthy stuff. At QSRs from McDonald's to Panera the cost of delivering a salad to the customer exceeds the salad's price. If you're a starving entrepreneur and you can be disciplined about shopping for value, the healthy stuff at QSRs might be your best bet on a daily basis.
I don’t know about O’Reilly’s contract but the one I’m familiar with provides for fairly generous reuse of content in blog posts, articles, etc. However, I very reasonably can’t just up and reprint the book or large sections thereof.
Curiosity and a desire to explore the unknown might bridge that gap. We after all are quite fascinated by whales, by the idea of living in the sea, and we even here are having a discussion about what it might be like to think having only ever existed in that environment. Whales may be similar. They know of land; they know of people in boats.

I guess I am suggesting tourism as a motivator.

EDIT: adding - I don't agree at all with that predator outsmarting point you made. Aquatic mammals often have quite complex techniques for hunting and evasion.
Yes, You can drive in the US on a foreign operator's driving permit
By convergence, I mean in the sense that two independent organisms that did not share a historical character trait (in this case, a specific homologous gene) independently evolved an identical trait (a gene with provably no homology, but identical function) through the process of natural selection, with no information sharing via horizontal gene duplication.

This was argued out a while ago with stick insects that lost and then regained the ability to fly (several independent subspecies did this). A lot of people thought it meant the stick insects "completely lost all the genes associated with wing formation" and then "gained an entirely new set of genes that caused wing formation", but folks in the evo devo world believe- and I agree- that the insect never lost anything except a few regulatory domains that managed the expression of pre-existing components that are depended upon by multiple other subsystems (IE, wings are composed of basis proteins that are used for many body parts).

My interest is in molecular evolution, not full character traits, because those phenotypes are incredibly complex and IMHO beyond our current level of sophistication in analysis.