skysight-inc/HackerNews huggingface dataset:
I agree with both of these issues. In addition to looking blurry, it is difficult to differentiate the hovered button by size alone. Consider adding a border or other effect to better indicate the hover state. A few of the other controls on the page do this. For example, the buttons you use below your section headings change their outline when hovered.
SmugMug is really bringing back sanity into Flickr, good to see this after the Yahoo fiasco.

I created Talegraph [1] as a platform to tell stories with your pictures, and it has been hard for us to explain to users why paying for the product is the only way to ensure your pictures will stay online and private.
Paying for what you use & privacy is not something normal people are used to, but this is the only sustainable way imo.

[1] https://www.talegraph.com
7 years ago, I worked on a government contract (not S,TS) trying to build a lie detector using computer vision and the research done by Paul Ekman (from the book Blink). After a few years of building models, we determined that it would be impossible to build an effective detector. I wonder if the research has changed.
Well how is my audience supposed to know what I have to offer until they have it in front of them? Before that it's just me telling them an idea. Even after it's done I would not expect users to start using it on their own. Then you have to play a whole different game of getting people to use it.
I used to be very opposed to JWTs but I can see some interesting use cases for them now, at least when using the variant based on public key cryptography. For example, if you need/want the ability to verify token validity locally (i.e. without making a call to you auth backend) they are very handy: Generate a token, sign it using the auth backends' private key and clients can verify it using the public key.

That said, I wouldn't use them as a default authentication mechanism as invalidation requires a connection between clients and auth backend again, as many people here pointed already out. It might still be easier to establish such a channel though than continuously verifying traditional tokens via the backend, which you can solve differently though as well: For example, for our APIs at KIProtect we cache validity information for (hashed) access tokens for 60 seconds on the API server, and we refresh the tokens in the background 30 seconds before they expire (if triggered by a request). Like that we can ensure that invalid tokens cannot be used after a short grace period (60 seconds is good enough for us) while not slowing down clients that perform many API requests as the token needs to be fetched only for the first request and will then never leave the cache (as it gets updated) if the client performs at least one request roughly every 60 seconds (or more often).
With content addresses instead of location based IP addresses.

https://beakerbrowser.com/
https://datproject.org/
https://libp2p.io/
It's an interesting reading (together with second part), but should be taken with a grain of salt.

Stateless sessions are useful under load and not necessarily under reddit-size load. I like 2-layered setup actually with long-expiration (1 year) "session" cookie kept on `auth.example.com` domain and short-lived (1 hour) JWT-cookie kept on `example.com` domain. JWT can optionally include permission for dangerous operations which is not automatically granted.

You still need redis to take care of forceful expiration, but that would be very simple call to the small list (1 hour of force-expirations if you reissue jwt-tokens on hourly basis), not data-fetching calls. We can keep this in a tiny redis-cluster colocated with frontend machines. JWT would have enough data to personalize cached templates. This will render really fast.

API-backend, database and larger redis-storages can be kept deeper in logical server-room and be accessed only on cold requests
> What am I missing out on by avoiding social media entirely?

If you're a company looking to advertise your product or service: the largest audience in the world.
Do you mean "delete the cookie" with "expiring it"? Then that doesn't help against an attacker which already has obtained the JWT, they can still use the JWT until it's expiry.
You make a good point. I think most of the paralysis and dread I feel comes from the fact that this is such a huge issue.

I've applied to volunteer at some conservation charities (Sea Shepherd, etc.) and am waiting to hear back how I can be useful to them.

I just can't shake the dread and negativity that comes over me whenever I think about it.
The problem is that if Facebook and Twitter are large enough, they can buy the next thing that becomes cool before it has time to beat them--like Facebook did with Instagram and WhatsApp.
I'm sorry, but yours is supremely paternalistic analysis borne of a believe that your fellow citizens are too stupid to have agency or act in their own interests.

And there is nothing visionary about China's great firewall since aristocrats have been trying to control the surfs since time immemorial by controlling communication. There is a reason antebellum slave owners did not want their slaves to learn how to read.
Saudi Prince Donates $40M to Harvard, Georgetown Universities (2015)
Thanks for the link to Berkeley Earth. I did not know about it. It appears to be exactly what I was looking for.
I'm hijacking this thread to say we need a better ID system for the web! That preferably work without JS. Something built into browsers, that also allow you to create as many identities you want. When a id-signup header is detected, the user see a signup button, and can chose what information is sent to the web site/app. The user can login to any site with the push of a button, or even automatically. With a built in public-private key ID solution your friends will have the same ID-public-key on both site A and site B. The contact list can even be inside the browser, and web site's can ask for it, allowing for example white-listing in messenger apps, or let the user pick who are allowed to see their family pictures, etc. And web sites/app no longer have to store, username/password/keys, they only have to make a "challenge" where the browser automatically proves the ID. The private key should be exportable and standardized, and it should be possible to also use smart-cards and second factor logins. Having ID built into the browser means every site/app no longer have to build and manage all this functionality independently.
I mostly agree. The only difficulty is that what people will say and what people will pay are not always aligned.
I'm not trying to troll you, but it's a voluntary "denial of justice". No one compels or coerces people to seek employment there. They apply, go through several interviews, and then voluntarily agree to whatever it is they agree to before day #1 of work. As long as people are willing to work there under XYZ conditions, people will continue to work there under XYZ conditions.
Whether a phenomenon is rare has a lot to do with how common it is. People getting shafted by kangaroo courts is rare when kangaroo courts are rare. What happens when you make kangaroo courts common?
A new book on the duty of resistance
Neo4j seems to have performance issues:
https://www.arangodb.com/2018/02/nosql-performance-benchmark...

And as far as I can remember from a former project the scalability is pretty limited (but this could have changed).
It's still far more generous that what Vimeo is offering: 5GB total storage & 500MB uploads a _week_.

1000 photos can go a long way if used in the way Flickr was originally intended, which as you noted was a portfolio of sorts.
Weekly Machine Learning Opensource Roundup – Nov. 1, 2018
Execution of Indonesian maid who killed employer while being raped
The same is true for HR; that's why there is additional rles around retaliation.
This is incorrect. The Catholic Church still practices the use of indulgences, just not their sale. See the Catechism of the Catholic Church which was promulgated by John Paul II in 1992 and last revised by Pope Francis this year.

http://www.vatican.va/archive/ENG0015/__P4G.HTM
I find pandas far easier to actually program with, whereas the tidyverse is better for quick one-off scripts. The tidyverse and its obsession with non-standard evaluation, makes writing functions more difficult than it should be, and readability goes out the window when using tidyeval.
A lot of replies to ChrisRR's comment go out to the global level, but Google can't fix that. The interesting question is "what kind of difference there is between the sexes when comparing like-for-like jobs" at Google. That's what they can address. Does it exist?

If it does exist, that's a very serious problem, because if Google can't and/or hasn't attained pay parity that would satisfy the people writing this, then pack it in; there's no way it's ever going to happen. Google is just about the best possible environment for parity to happen in, with an almost uniform culture that would support it from top to bottom and enough money that it can pursue almost any parity policy it wants without a serious problem, and a long time frame in which this all should have been true.

If there is still systematic, unsatisfactory bias at Google, what hope is there for these ideas in the rest of the world?
16 bits give you 96 dB SNR only if your signal is one-bit. In a quiet room with decent headphones set to comfortable level I can easily hear one-bit flips in otherwise silent WAV file.

Not a problem for popular music that's consistently loud, but a real problem for classical music with wide dynamic range.
You don't have to have a lot of trust in the government, just more than you do in corporations. That's not a terribly high bar.
> What am I missing out on by avoiding social media entirely?

Accidental discovery of things important to you.

I'm no fan of Facebook, but shortly after I signed up I found out that my sister, who was fighting cancer, was in the hospital again. I went to see her, and we had the best 1:1 talk we'd ever had.

She passed away a few months later.

Yes, in an ideal world I would have been in proactive contact with everyone and might have found out independently of Facebook, but maybe not: she was only there for a couple of days.

Anyway, there is something to be said for a central clearinghouse of information relevant to your interests, your family, your friends. There are many problems with social media, but there are many positives as well.
They are comparable in a sense that they both went beyond literature, it becomes part of the culture, even the language itself.

Jin Yong's novels are so influential and intervened with contemporary Chinese culture, where his characters have become the go-to reference for certain archetype personality. Like you can refer to something that is short as Hobbits, if you are calling someone 岳不群(pronounced as Yue BuQun, a villain who appeared as leader of the good guys at first) in Chinese, it is even more insulting than calling that someone hypocrite.

In fact, considering that Jin Yong had not only several, but 14 installments to create his imaginative JiangHu universe, most of which are vastly popular and recognized and all of them are adapted into movies/tv series, even nowadays, I would say his influence within Sino cultural sphere is probably wider and more profound than that of Tolkien as with English/Western culture.
Guest WiFi usually uses a captive portal, I think. I don't think that would work with something like Google Home, which expects to have internet access right away AFAIK
In the past, I've compared the "iat" (issued at) value with a column in the users table called "invalidate_tokens_before". If I need to invalidate tokens for a user (for my use case, it would always be all tokens for a user at once), I just touch that timestamp column. True, it still required a db lookup (one that happens anyway), but I found that easier to manage than storing and managing session tokens.
What 1 big company do you think invented the smartphone?
Does anyone force you to use Google’s services?
Wouldn't make a difference. People will find something to blindly believe in regardless. Just look at politics.
You can't access a cookie from JavaScript if it is marked with the HttpOnly flag.
That poll seems extremely biased by the fact that they're your followers.

Beyond that, your answers are leading, and don't include the proposed "Source availability". When you put a poll this way its obvious that people will choose specific answers.
People voluntarily entered into indentured servitude once upon a time, too.
While there is no meaning associated with that character, it does have a recorded reading.

https://jisho.org/search/彁

It is read "ka" or "sei".
I don't think you could break them up in any meaningful way. What would you break Apple up into? The company that makes iPhones and the company that makes iPads?

Or Facebook? Two social networks that get half of the population each?

Breakups only make sense for vertically integrated companies. I guess you could break up Google (it's already done so itself to some extent with the Alphabet reorg) but not in a way that's meaningful, other than maybe requiring advertising to be its own company.

Also it neglects the fact that their biggest asset is their domain name. Google.com might be worth literally trillions of dollars. How do you break that up?

If anything, I'd argue the government could regulate Facebook since it's basically a natural monopoly, much the way it does the NFL or basic utilities.
Starlink network topology simulation and predictions
I commend the Flickr team for making this move. It takes courage to make this kind of change, when you know you'll take some flak for it (e.g. this very HN thread). At the end of the day, you'll piss off some people, but you know that the decision makes sense and you forge ahead.
> I can do everything I need to without Google, but not ATT.

I'm betting that you actually cannot. If you blacklisted Google's domains many sites would be inaccessible or broken due to reCaptcha, Google-hosted fonts/scripts, or ad-blocker blockers.
Very glad to hear you've chosen a solid Python stack for your application :)

We absolutely wouldn't be where we are without our community. From drivers and tooling to the huge amounts of support and goodwill that we see, it's a wonderful ecosystem to be a part of.
I suppose that you are familiar wuth analog modular synthesizers. There is a demand for these, even though they become very expensive toys fast. But musicians seem to like the flexibility and room for experiments that they allow. Even software simulations of these synths are pretty successful. VCV Rack (http://www.vcvrack.com) is a recent open source emulation of eurorack synthesizers that has found a following fast.

If you are interested in providing procedural audio for games, you should take a quick look at what WWise provides in that area. I have not had time to do that myself, but from what I have seen it provides a lot of features for controlling sound and music based on the current game situation. It is also a pretty expensive package.

Edit: corrected link. Thank you striking!
If you set cookie httpOnly, Javascript cannot see it. So some malicious third party library or XSS attacker cannot steal session. It can still do requests and cookies would be included, so stealing is the main difference.
0x20k of Ghost Squad Hackers Releases #ODay Exploit Targeting Apache #Hadoop
> You can access cookies from Javascript, so how is localstorage worse?

You can access it via JS only if you don't set the httpOnly flag on the cookie.
Hmm, true you're walking the code already. What you don't do is look at the lexical context or maintain it while walking.

S-expressions in full Lisp don't specify lexical constructs, it is only the pre-cursor of such (people often say that S-expressions are the AST of Lisp, that's not true if by AST one understands to mean that each element's functionality is clear, e.g. if it's a function call or function abstraction or constant etc.; an S-expression only specifies a computation given a lexical compile time context).

What you (and SICP) are doing is look for symbols like +, regardless of whether + is bound to the addition function or something else. That is fine if that's your intention (it's certainly easier to implement a code walker for and you can often get away with it). If playing/deriv received

(+ (flet ((* #'+)) (* x 2)) 12)

instead of

(+ (* x 2) 12)

then it would need to be able to handle the flet form, and maintain the aliasing of * to + in a lexical context that playing/product? has to inspect to know if it's dealing with multiplication (and return false in this case). (Caveat: I'm a Scheme, not Common Lisp user, I hope I got the syntax right above.-- Edit: I didn't; this apparently violates CL because it tries to shadow a standard function name, additionally the flet form apparently requires function definition syntax not just value, i.e. (flet ((* (a b) (+ a b)))..). So, my argument becomes a bit moot in CL as the basic operators can't be shadowed anyway, except I'm told that you can define them in a new package then import them, but then I'm not sure you can rebind them lexically. Scheme is beautifully simple in comparison, it doesn't try to prevent you from shooting your foot but of course encourages to learn to deal with the consequences, which is why I wanted to write my post. It will still be true for the general case in CL, too.)

Most programming languages parse from strings (possibly via tokens) to an AST. Lisp parses from strings (possibly via tokens) to S-expressions then to an AST. I just want to point out that one has to be careful here, and want to point out that Lisp isn't fully parsed in the sense that one has got an AST, when you're at the s-expression stage.

> More accurate to just say no lexing and tokenization?

The read function does more than tokenization, it doesn't give you a stream of tokens (that includes open and close paren token), instead it does give you a hierarchical expression representation. Yes, you don't need to tokenize, but even don't need to do more than that. I don't know if there's some CS term for that, in Lisp it's just "read".
Just a little nit: files, directories and paths are popular concepts today due to the prevalence of hierarchical filesystems, but not necessarily fundamental to computing. You can have a computer without any of those things, just not one that looks like today’s computers. My home computer in the 80s had only one of those(files) and even that concept was optional because storage was optional.
I think you nailed the marketing of this change. Though, if Flickr posted the steps/goals to making the user a "priority" rather than a "product," I would be more convinced. A cursory read of their TOS doesn't indicate any changes (though this may be premature as the changes are not in effect), and their (1)non-blog upgrade post doesn't seem to indicate any changes in data collection/selling.

As an aside, if you were looking to subscribe to their Pro product, the link in the blog post contains a coupon for $15 off their yearly subscription.

1. https://www.flickr.com/lookingahead
You only have 2 choices for mobile OS, dominated by Apple and Google.
I sometimes don't understand why technical people seem resistant to "lean startup" methodologies. It's just the scientific method, applied to build a product! You build hypotheses, then try to prove them, and in the course of this, usually learn more information about the world. That simple.

You think you have a product which is useful to someone? Prove it! Talk to people, ask them, build simple prototypes of the core parts.

You think you know how to sell your product? Prove it! Build out some sort of pipeline, e.g. use a landing page and see if you can get people to it.

Etc.

There are good and bad ways to do this, obviously, and it's not easy. But the basic idea is simple enough - and most of the arguments against it sound pretty much the same as how it would sound for someone to be against scientific experiments and hypothesis testing.
It's not the "ether" that's changing the phase, it's the relative length of the interferometer legs. That depends on the direction the waves come from.
I tried several times to get through this article. I thought it was just me.
> Selling something before you make it is highly unethical. You have no idea if you can actually make it, so you run the risk of committing fraud.

Wrong and wrong

It is VERY common across all industries to have customers pre-pay. In fact, I wouldn't take a potential customer's "interest" in meaning anything if they don't put their money where there mouth is.
> aristocrats have been trying to control the surfs

This humorous typo brought to mind the anecdote of King Canute and the tide.
Official US policy against Iran is that they should suffer sanctions despite adhering to the treaty that got them lifted. Trump alsomoved the embassy, discarding all the policy against itfor no good reason.

That Trump would tell bibi to go town if he wants to is extremely plausible, it’s pretty weird to question that.
Lots of people in the entertainment business are expected to be able to promote stuff via their social media channels. For example, if two actors are up for a role and one has a hundred followers and the other has a million, the more followed actor may have an edge.

On a more personal level, you might not see your nephew's piano recital.
How does Aragon's effectiveness for this compare to e.g a Google Docs spreadsheet?
Prof. Sarita Adve of U of Illinois Wins ACM/IEEE-CS Ken Kennedy Award
> Our society was built on large amounts of discretion being exercised by law enforcement

This I get.

> and the ability to convincingly lie to law enforcement.

This less so. Can you elaborate?
Are we sure they still won't sell you to advertisers in addition to subscription fees?
DirecTV and others' Rx only geostationary market is 50x larger than small two way vsat, because most of the USA doesn't need vsat service. They're all based on standard cheap geostationary rx only tech. A DirecTV dish and feed + lnb are super simple and cheap to manufacture.
This is pretty explosive. I had no idea of this. Is there an alternate source to the claims?
That was what first caught my eye as well, which would make it impossible.

> The affected code must not only be released, it must be made available under the SSPL.

But I think it should be interpreted that if you modify the code (mongodb) under SSPL it should be distributed under the same license, like is normal for other open source licenses.
People are still using flickr?
A SaaS offer sounds like offering MongoDB as a service. The lawyers would enjoy hashing that out for billable hours.
Crunchbase has a Built With section. I'm not sure how its constructed, but I'm guessing it only looks at what it can determine from a company's site. I suppose github could be another source.
I rest my case, sir.

I also wish you the very best with your activism.
There is no greater indicator of interest than having a customer willing to pay up front. I have been on both sides of such deals in my career.
Interesting, thanks! I wonder if that's algae photosynthesys, or plant photosynthesis - arguable the latter is "less efficient" because we eat only parts of the plant.

In any case, I'm surprised that electrolysis is so efficient. I remember reading that it's so inefficient that the primary source of hydrogen is currently actually natural gas! And I wonder how sustainable is the process - doesn't electrolysis deplete the anode and catode, which need to be made of expensive materials for reasonable efficiency?
As someone with way more than 1000 photos on Flickr, I hope they provide an easy way to export the photos and metadata out.

I mostly agree with the direction they want to take, I just don't want to be part of the journey and so want to get my photos out.