skysight-inc/HackerNews huggingface dataset:
I don't understand these concerns. I have published my data from 23andMe (https://enki.org/2017/10/17/publishing-my-genome/) (https://github.com/mcculley/genes-genes). Can you share what you think the bad outcomes would be? What am I missing?

Edit: As people bring up the insurance risk, yes I did consider that and mention it in my post. I am personally not concerned about it and think the advantages outweigh the risk. Besides, I think insurances companies are going to have all the data soon anyway. If every time I get a blood test, they have a chance to capture my DNA, how can I stop them?
Just because you personally misundertand a concept it doesn't mean everyone else is wrong.
Does anybody know how jobs decided to base next on open source code (bsd)? It seems sort of antithetical to everything he stood for.
I've probably hired around 50-60 tech workers in Toronto. Only entry level (degree plus a year or two of experience) were paid close to $60k. Most of my team was between $75-110k. This is four-five years ago so I imagine it's higher now.
>No, I mean they own the contents of your correspondence because you can't get the emails out.

Isn't this just a variant of the "can't access your mails without using their client" argument? If you're really keen on using your favorite IMAP client, pay for premium and use their bridge.

>No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.

How does that solve the issue of them (protonmail) stealing your password (and thus the private key used to encrypt your emails)? They need your private key to decrypt your emails server-side. If they have your private key, they can decrypt all future and past emails. Worst of all, it's totally undetectable, unlike the backdoored javascript threat that you mentioned earlier.
How long has your account been open? Did you already get everything verified (ID)? And are you in the US or outside?
I haven't had any issues with either SMTP or IMAP on Fastmail. I've even used their IMAP server by hand with no issues. Here is the IMAP capability list (which shows protocol extensions supported) before logging in:

* CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ENABLE UIDPLUS SASL-IR NAMESPACE CONDSTORE SORT LIST-EXTENDED QRESYNC MOVE SPECIAL-USE CREATE-SPECIAL-USE IDLE AUTH=PLAIN

and after:

* CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE ACL RIGHTS=kxten QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY CATENATE CONDSTORE ESEARCH SEARCH=FUZZY SORT SORT=MODSEQ SORT=DISPLAY SORT=UID THREAD=ORDEREDSUBJECT THREAD=REFERENCES THREAD=REFS ANNOTATE-EXPERIMENT-1 METADATA LIST-EXTENDED LIST-STATUS LIST-MYRIGHTS LIST-METADATA WITHIN QRESYNC SCAN XLIST XMOVE MOVE SPECIAL-USE CREATE-SPECIAL-USE DIGEST=SHA1 X-REPLICATION STATUS=SIZE OBJECTID SAVEDATE X-CREATEDMODSEQ XAPPLEPUSHSERVICE LOGINDISABLED XCONVERSATIONS COMPRESS=DEFLATE X-QUOTA=STORAGE X-QUOTA=MESSAGE X-QUOTA=X-ANNOTATION-STORAGE X-QUOTA=X-NUM-FOLDERS IDLE

They only have the TLS ports open; the plain text services are disabled (no need for STARTTLS since that's insecure from MITM).

They allow having a password different from the account password specifically for these services.
> From the outside it's a weird juxtaposion of a traditional, old (from a European point of view) system of state and an everyday modern way of conducting scientific research. You'd just not expect this kind of contact, somehow.

Well, what seems to be the most visible European monarchy outside of its own country (the British) seems to still largely adhere to the custom of the monarch (and, to a lesser extent, the close royal family) refraining from anything that looks like work (military service of the close royal family being a notable exception) outside of royal duties, which might color that expectation.
What you're neglecting in your argument is the weather of central coastal CA. Not only is it far more temperate, it also lacks the constant threat of hurricanes or blizzards. Small earthquake chance, but nothing serious so far. There's a reason the deep south is so cheap - no one wants to summer in our heat and humidity! And very few people enjoy surviving the winters of Detroit.
Nextdoor CEO to Step Down
I asked 23andMe if there was any way to delete my genetic data from their site after the Equifax hack news. From their response:

"23andMe and our third party genotyping laboratory will retain Genetic Information, date of birth, and sex as required for compliance with applicable legal obligations, including the U.S. Federal Clinical Laboratory Improvement Amendments of 1988 (CLIA), California Business and Professional Code Section 1265, and College of American Pathologists (CAP) accreditation requirements.

23andMe will also retain limited information related to your account and data deletion request, including but not limited to, your email address, account deletion request identifier, and record of legal agreements for a limited period of time as required by contractual obligations, and/or as necessary for the establishment, exercise or defense of legal claims and for audit and compliance purposes.

We recommend that you review our full Privacy Statement for more information about deleting your data before submitting your request."

So basically, once your in their system, you can't get out.

And you're paying them money for this.

Any way to do self-DNA testing?
Put this way. Sophisticated data mining feeding models that forecast the value of your startup or large customer base.....ain’t science. No amount of ML icing on the cake is going to make the (economic) forecast more accurate. It’s good journalism at best.
Sorry, I worded that poorly. U2F keys will continue to work fine, it's just the Javascript API that sites use that'll change. As a user, everything will keep working.

Webauthn allows (but does not require) a mode where the key is a single-factor (i.e. acts as both username and authenticator). You need FIDO2 keys for that and we plan to support it in Chrome. Sites will decide whether that makes sense for them.
The thing about cancer is that you can live a perfect lifestyle and still have it ravage your body.
Don’t you think insurance companies might want that data to price your coverage for their optimal margins?
No,

"A curve designer cannot protect against this attack by choosing better curves"

https://safecurves.cr.yp.to/twist.html
I have a tangential question about 2FA since there's been a couple of articles recently on HN about U2F/FIDO/2FA. Is there a reason almost no banks offer 2FA?

I really seems absurd that in 2018 a person's gmail/dropbox/github etc has better security practices than an online bank account.

EDIT. Some people assumed this was a US-centric question/perspective. If you look at this list. The number of checks for banks offering either hardware/software 2FA is pretty dismal:

https://twofactorauth.org/#banking
A quick word on which versions of Mega Man X Legacy Collection to get–or avoid
> However, given how low-level a language C++ is, we can actually break this assumption by setting i to y-x. Since &x[i] is the same as x+i, this means we are actually writing 23 to &y[0].

> This assumes that the address space of y starts at the end of the address space of x?

No it does not. Any value of x or y should "work", because y-x computes a difference between pointers.

> Could these two allocated blocks of memory ever not be continuous?

Probability they're not continuous is high and only gets higher as the heap gets more fragmented over time.
Insurance is the first one that pops into my mind. That kind of data changes their bet on your risks heavily into their favor and can disadvantage you if your genes show anything corroleated with late onset diseases. Depending on how this information is regulated, it could also affect the insurance for your biological children.

For more hypothetical societal risks, I’ll cite the movie Gattica where DNA credentialism has created an underclass of people who can’t afford genetic manipulation at birth of their children. If your DNA is found wanting in that society it could be used against you in job applications, rental applications, etc.

Currently (IANAL) but I don’t think this would be legal, but once your information is out there, it’s rather hard to bottle back up.
It's possible they might have considered giving up on hardware and making a pc-compatible macos?
More like 42%.

https://www.cancer.org/latest-news/more-than-4-in-10-cancers...
For what it's worth, that's low enough to be near-scam level in Toronto. Someone with even a modicum of experience shouldn't have a problem getting $80-90K (still well below SF levels, but not THAT low). SUPER early stage startup (like pre-seed) might be an exception, but that's almost more of a co-founder situation.
So the co-authors have an Akihito Number of 1. Does anybody on the thread have an Akihito Number of 3 or less?
Could someone explain the difference between FIDO and FIDO2 compliant keys? For example, is new hardware required or will existing FIDO/U2F keys work with FIDO2? It looks like Yubico is advertising a new FIDO2 key under the brand name "Security Key by Yubico". Personally, I've been meaning to pick up a U2F key, but if sites are going to start rolling out WebAuthn support, I'd rather have a key that supports both FIDO and FIDO2. Does anyone have a recommendation?
I did it briefly. It was fine, but made easier because I have citizenship in one country and the right to work in the other.
that limits it to the moment the email was received, which is still better than everyone else, where you can read the mail any time in the future.
> What happens when there isn't a conda recipe for some package or inexplicably some dependency?

You go contribute it on conda-forge? The conda team is also actively working on improving some of these problems specifically for python users. When you create a new conda environment with python in it, we put pip in it for you too. In a way, we're implicitly encouraging you to use pip along with conda, and yet it's not a seamless experience. So https://github.com/conda/conda/issues/7053 is a current effort. Eventually, we're working toward conda being able to install wheels directly (at least pure-python wheels at a minimum), so that packages available on PyPI that conda-forge or Anaconda haven't built out yet can still be installed with conda.

> Do I go back to pip? sudo pip ;) ?

If you're putting `sudo` in front of `pip`, you're probably doing it wrong ;-)
> No to mention the fact that all the cancer drugs in the world will not save us from an asteroid. If we don't get people living and populating on other planets, the human species is doomed.

This is what I always come back to. Curing cancer is a great form of self improvement for the human race, but essentially that's like an ant colony learning how to make it's ants live a little longer. It doesn't protect from floods, or fires, or even an exterminator. What does? founding new ant colonies in different locations. Many of them.

Additionally, the caveman analogy is apt. A balance needs to be struck between advancement, and standard of living. Too much focus on standard of living and you reach the cap of what your technology is capable of. To much focus on advancement and people suffer unduly (and too much of that is unsustainable). To me, the parallels between this and the whole socialism and capitalism extremes are obvious, and similarly, we're best off with some shifting middle ground rather than at the extremes.
I wasn't asserting that they were pervasive or even universal (in the Unix universe).

Perhaps I'm missing your point about dbm, unless it's just that libraries existed, even long ago, that happened to open files. That doesn't refute my point, which is that a process operating on those files via that library and outside of that library is incongruous.

As further evidence for there being at least an idea of such a dual "class" of files, I present the fact that the * glob does not match files starting with a dot.
I don't see a demo button, where is it?

Edit: I see it now, the browser window has to be wide enough and not zoomed in, otherwise the page goes into mobile view and the button disappears.
I think the dialogue quoted here demonstrates the underlying issue that is lost in futurist thought.

No one "pioneered the west". Various groups of people with powerful technology traveled west and stole land from other groups of people. They also traveled south and east and used that technical and economic power to enslave other humans and forced them to develop the west. Development and progress for progress' sake alone leaves a lot to be desired, namely, ethics.

Also, It's clear that much like economics, technology doesn't inherently trickle down. It certainly has the potential to have positive downstream effects, but without having a priority of pushing those positive impacts downstream I would argue that we're left with a larger gulf between the marvels of modern science and technology and those and the bottom. That is to say, without prioritizing equalizing the gains of science and exploration and those gains actively stratify society further.

There are many, many people in the world who don't know that we went to the moon, there are people who don't have access to electricity and plumbing. I'm not arguing here for not exploring other planets, but I am trying to make a case for focusing out scientific efforts of improving the lives of everyone on the planet. Without spreading the achievements of science and technology to everyone on the planet, humanity is doomed.
Saving for short-term goals like a deposit on a home, purchasing a car or other big ticket items, starting a family, taking a vacation.
Does Europe Have the Potential Become the World’s Leading Blockchain Hub?
Sure, but it's the refining that gives you the perchlorate.
It may be that GSK isn't really interested in the existing 23&me product line, but wants their name recognition and infrastructure. 23 is as close as anyone to delivering a full GWAIS product to the public, which this partnership only enhances. Combined with large capacity cheap deep sequencing by someone like BGI, this partnership would be ideal for GSK to add in-house infrastructure to do a LOT of GWAIS for all kinds of drug target ID efforts or clinical patient stratification.

Maybe GSK has decided to target patients very precisely as standard practice in all future drug trials. This makes a lot of sense if you want a new drug to maximize efficacy or minimize toxicity by cherry picking your high responders and low intoxicants, thereby easily avoiding all folks who don't benefit from it, even if no-go patients are in the majority. But it also assumes such cherry labels will be available to physicians and insurers soon, presumably as de rigeur medical practice for the general public. Streamlining a product like 23's might make this initiative fly economically.

Done early in a drug trial, like phase II, you might be able to use deep genome data to tune up or rescue a new drug that looks promising but not quite promising enough to continue to phase III. Deep genomic analysis is a very promising way to stratify patients who will benefit from those who won't.

This looks to me like GSK has just bought into GWAIS in a big way for thousands or more patients, esp in clinical trials. This partnership can only help both companies, since I don't see a major pharma ever trying to take over 23's existing boutique geek navel-gazer business.
Tutoring isn't rent-seeking. It is not in any way analogous to charging money for some commons that would otherwise be free (like the toll-chain-across-the-river example). If the parents feel that $100 is excessive, they can find another tutor. That teacher doesn't have a monopoly on mathematics.

> And this is at a very competitive math and science charter school who routinely sends people to the top math and science colleges in the country.

So that tutor helps do the job, and the rich parents find the rate acceptable.
From an outsiders perspective, this seems like corruption.
Great feedback. Thank you.

The per $1k pricing is only on dollars over the $20k base. We're planning on a adding price meter a la Segment's pricing page, just a matter of javascript-ing it up.

I just pushed a change (30s ago) that adds the platform cut question. We base it pre-platform cut because it incentives us to reduce the platform cut if possible: by getting more subscribers to the 1 year mark, or by getting subscribers on to cheaper platforms (like Stripe.)

And yes, lifecycle campaigns are something we want to get into. Since we're not in the business of push notifications, we'd probably just let you integrate your OneSignal or Braze key and we could send hooks to them so you could trigger whatever kind of custom campaign you wanted.
I mention the insurance risk in my post. Yes, I do think insurance companies will try to use this data. I don't see how to avoid it though. It seems to me that it is inevitable that they will get my DNA at some point. That said, I buy insurance for the unknown risks. If I had a known condition, I would expect that to be factored into the price.
> We have webhooks that are like Apple's server-to-server notifications, but not terrible.

That made me chuckle. Sounds like event webhooks + ETL exports should cover everything. So far Apple's metrics have not only been very limited, but the fact that we can't relate them to our user data means that they're almost useless. You can't segment by demographics, correlate to the user's history (are people who do X more likely to convert?), you can't even a/b test.

Any company that is on the AppStore and takes themselves seriously needs to know what they're making off each individual user to the penny. If RevenueCat helps with that, then I expect you'll do very well.
"I would be interested in how you would do especially the tr part in sed..."

There is more than one tr part. :) I tried to be careful to refer only to where the task is replacing characters.

As for joining lines, I have used the same tr -d '\12' technique quite often in the past if the input is not contained in a file. For files I would sometimes use ed scripts.

IME, sed is one of the most ubiquitous programs in UNIX-like OS. I use it daily. However when sed cannot do the job or cannot do it fast enough, I use flex to write relatively small, single-purpose programs quickly. There is a good chance they will compile cleanly on a variety of OS. Perhaps flex is as available to the user as tr, mkfifo, openssl, etc., i.e., when the user has access to all those programs she also probably has access to flex, cpp, as, ld and cc.

I would be happy to provide an example directed at the xmpp-echo-bot solution if you can provide some sample input and the desired output, ICPC-style.
CNN really doesn't produce infotainment content that passes the acid test of HN guidelines. CNN is far from cerebral these days, and there are a number of factors that have caused them to shift focus. CNN's coverage of the early days of the 2003 Iraq invasion is pretty much the last useful thing they've covered, and certainly they weren't in the business of criticizing it at the time.
What an insightful comment. Thanks for such a detailed explanation! I feel like I learned something interesting today.
Primary concern is declining insurance coverage, unless 23 and me allows for a anonymous no name test?
Yes. Every time I've watched the landing video since I have to remind myself that I saw the landing in person and that it's not CGI.
This is a great tool. I hate inspecting element to check computed css properties to troubleshoot issues for our clients. Definitely worth a shot.
Yes, I mention this in my post.
> We should fix our problems here, today, before exporting them elsewhere.

Although, if we export them, that's that many different places to try out solutions in semi-isolation in an attempt to find one that works. If we can parallelize the process, and also get cleaner starting conditions to test, why shouldn't we do so?
This is a fantastic tool! When I was younger, it was great to be able to experiment without needing any hardware and while having more visibility into what was happening. Especially cool that it lets you play with memristors.
Yes, flimsy DH implementation+ invalid curve attack

"Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange"

https://www.kb.cert.org/vuls/id/304725
No, they could just transmit PGP encrypted emails down IMAP and the user could decrypt them with any number of popular PGP implementations. Your IMAP/SMTP password doesn't necessarily have to be the same as your PGP key password, nor should you even need to give Protonmail your PGP private key (password protected or not), nor does IMAP/SMTP even have to be authenticated with a password (GMail notably pioneered an OAuth-based extension to both).
I used and enjoyed circuitlab.io until it went for-pay only. Nice to have an easy to use free alternative for very casual hobbyists like me.
Typically the cashier can "turn on the pump" (enable pumping prior to paymemt) on request, and you can pay after pumping.
“The insurance companies will eventually win this from us” is different from it currently being required. I will read your post but I don’t buy the inevitability that they will win over reasonable privacy rights.

Insurance only works as a system for society if the risk is spread among many parties, but if the insurance companies know the risk ahead of time it ceases to subsidize the unfortunate, who are left out in the cold (taxpayer funded programs and hospital ERS)
VMs are an easy copout to a problem that shouldn't be a problem in the first place.
Personally my H1 was denied by Trump administration citing some BS reason. I have been here for over 12 yrs and work in a decacorn as a PM. I am looking to move to Canada.
I had the same problem. I used to think that drinking a cup of coffee after lunch would help, and it did, but after a few months it stopped being effective and only made it harder to fall asleep in later in the evening. However, about a month ago I started aggressively fixing my sleep schedule and stopped consuming any coffee, and I now don't experience these drowsy after lunch periods at all.
Yes, but the poster loves his dog more than any human has ever loved their child. He does not merely conform to societal norms with such love.
If I'm not mistaken China has one in the works as well.
What if we allow the mapping function to be stateful?
5 Mistakes Companies Make About Growth Mindsets
1. You can export your mail directly from the web app in EML form, using the bridge, and soon, from the import/export tool which is currently in beta for Visionary users.

2. We support IMAP/SMTP via the bridge (protonmail.com/bridge).

3. You can run the web client lcoally if ProtonMail itself is part of your threat model (github.com/ProtonMail/WebClient) and the rest of the clients (mobile and bridge) are working on open sourcing soon (mostly library/API version updates and documentation).
Well, because, to quote Russel Peters "Indians are cheap" [1].

Not meant in a bad way, they probably just aren't as much for conspicuous consumption like e.g. the US or Chinese middle class is.

And if you can 99% of the stuff with a cheaper Android phone, why go iPhone?

The iPhone doesn't buy you anything you can't do -- it just adds some luxuries and niceties to the experience (provided you're not a tinkerer).

[1] https://www.youtube.com/watch?v=oSzgCDIUzq0
>If you're really keen on using your favorite IMAP client, pay for premium and use their bridge

No, that's absolute bullshit. Paying to export your own data from a service is nuts. Not implementing features which have been expected from every mail server for the past 20 years is nuts. This behavior is inexcusable.

>They need your private key to decrypt your emails server-side

No, they don't, they can just send you PGP encrypted emails over IMAP and you can decrypt them client-side. This is how it works for everyone else.
HN hivemind: the only cure for a Google bug is... more regulation!