skysight-inc/HackerNews huggingface dataset:
Agreed: the scientific community is supposed to havea consensus on [Popperian] falsificationism but seem to act like they don't really believe it quite often.
'Journalists and Entrepreneurs Should Be Allies': Media Startups Valencia
If you need to access the DB to check if you can emit a new SLJWT, what's the point of the LLJWT? Why not just store that UUID by itself?

The SLJWT does seem useful, but 1h seems too much; if I fear someone might be (for example) accessing my email account using a stolen or hijacked device, they can do plenty of damage in that time. Do you make it clear to the user that their request for a remote sign out might take that long to be applied?
Do you believe that the 24-core $1500 server processor can beat the iPad in single to minimum threaded workload?
Everything an iPad can do with that amazing touch screen.
This may not be part of the spec per se but you can invalidate them by distributing a bloom filter with revoked tokens and validation times, services just need to poll the service at the granularity needed. This makes scaling still much simpler than one big session store.
They're being considerate by using your IP. They're not a EU company. They have no obligation or requirement to respect the EU laws, so them adding that feature is them at least acknowledging the EU has regulations they do not follow. If you want to circumvent that by using a VPN and deceive their servers, go ahead. While sure, under the GDPR that would still hold them liable, they're not located in the EU and therefore have no reason to spend the extra effort to find extra ways to try and prevent you from accessing their content.
Low prices means higher consumption, which will do the opposite of kill off that project.
Scientists finally confirm the Milky Way has a supermassive black hole
Tapad | Full-Time, Onsite: NYC or Oslo | Open Compensation

Tapad is known for inventing and introducing the Tapad Device Graph™ to the industry. At the heart of it, we dig data.

Tapad's Open Source tech stack (below) handle:

___________________________________________

Distributed Applications... Scala, Python
Distributed Computing... Google Cloud, BigQuery, DataProc, DataFlow,
Open Source Technologies… Kafka, Zookeeper, Spark

Here are our open roles in Engineering:

VP of Data Science (NYC): https://grnh.se/d6ca30361

Senior Software Engineer- CDP (NYC): https://grnh.se/9b3fdbe31

Senior Site Reliability Engineer (Oslo): https://grnh.se/dcd5e0351

Senior JavaScript Engineer (NYC): https://grnh.se/bed5db991

Senior Software Engineer (Oslo): https://grnh.se/cb1ba4661

Software Engineer in Test (NYC): https://grnh.se/2c0d67e71

Software Engineer (Oslo): https://grnh.se/84d6d48d1

Senior Quantitative Analyst (NYC): https://grnh.se/bde5dcdc1

Lead Solutions Engineer APAC (Singapore): https://grnh.se/4a4ecd021
To everyone @ Neo4j, on behalf of the Graphistry team, big congrats!

This may help non-graph folks understand the community a bit. Neo4j has a bunch of cool bits, and it's been a pleasure watching them bring two specific "aha!" moments to customers. Our tech helps teams build scalable visual workflows that include visual graph, so we're often brought in near the beginning of a graph project, and have repeatedly seen two situations where a DB at Neo4j's quality shines:

1. Performance: A teams starts using their existing data stores -- SQL, Splunk, etc. They'll get quite far. Often, however, they will hit some query that just cannot perform. E.g., for two bank accounts, all paths between them. For different DBs and workloads, these can be different things.

2. Ease: Asking for something like a 360 view around a device, user, patient, account, etc. is hard in sQL - you don't know what column, table, etc. to look at. Or imagine the above shortest-paths query. Cypher makes writing this stuff EASY, so in a world where a lot of people can barely do SQL, that's a superpower.

Neo4j has been broadening by entering the scaleout world, app dev world, and adding multi-modal & ML capabilities, which are all important things and help grow the eco-system. Congrats again!
Zipcar | https://www.zipcar.com | San Mateo, CA | ONSITE Full-time (VISA) | Firmware/Embedded C/C++ and Rust

Zipcar is the world’s largest shared-mobility company. We are expanding our engineering team at our SFBA office in San Mateo, and we are looking for passionate, innovative people to help develop our next-generation telematics platform, and keep tens of thousands of in-the-field devices humming. Best of all, you can push the state of the art while you do it with Rust!

We are in the early stages of a green-field redesign of our in-car telematics platform, and are making a big play to write the firmware in Rust. We have support from upper management to open-source what we can (a sampling of the repos is here[1]), and are legitimately pushing the cutting edge of what's achievable. It's _incredibly_ exciting, and you can join us in building first-of-their-kind secure IoT devices. Beacuse it's a new and growing language, we're also realistic about letting our people grow into Rust expertise, and value flexibility over resume bullet points.

The rest of our stack is bare metal C on PIC and RTOS C++ on ARM, with Java on the server/data ingestion side, so you'll need to be at-least-conversant all the way up the stack. When we say "full stack", we mean it! :)

What will you be doing it for? Building connected-car technology for multiple product lines, including Zipcar and Avis. By putting our massive fleets behind an API, we are aiming to be the AWS of transportation.

Example of our connected car work for Avis: https://www.reuters.com/article/us-avis-budget-grp-tech-kans...

Overview of our partnership with Waymo: https://www.theverge.com/2018/8/21/17762326/waymo-self-drivi...

News about our partnership with Lyft: https://money.cnn.com/2018/08/06/investing/avis-budget-lyft-...

Mission-driven. Small team. Flexible working conditions. No worries about funding. :)

I have never been happier at a job; this place is great. I build solutions that breathless news articles (still!) talk about happening in the future. I help to move the state of the art in embedded Rust. I'd be one of your peers, and I'm happy to answer questions off-the-record (hn profile address) or on (bmatthews!zipcar,com)

[1] https://github.com/thenewwazoo?utf8=%E2%9C%93&tab=repositori...
Actually, that is in the manual. That's a feature of the product. You can watch and speak through it. Just because a stranger got your password from an unrelated security breach to Nest, doesn't make it Nest's fault. They have the tools available, and even encourage you in the setup process to setup 2-factor (I just recently set one up). Outside of that, this is user error, in my opinion. Nothing was "hacked" on Nest's end.
Amazon Raises Minimum Pay for Everyone–Except These Workers
Many people don't use facebook. I thinks WhatsApp is a better example, it's even more ubiquitous, though I'm sure there are still people who don't use it. Heck, I'm personally thinking of stopping, it's just that everyone is there. Two of my recent orders were negotiated by WhatsApp. It's used almost universally.
> That has nothing to do with JWTs.

Progress! You're so close to understanding the article.

It wasn't ever about JWTs in particular. It was a response to a widespread engineering antipattern of "storing all session state in a cookie then maybe encrypting or HMACing it so you don't have to store anything server-side". JWT was just how developers tended to implement this antipattern.

Like, literally, that was the entire point of the entire article that Sven wrote.

The examples of apps that do this have become less common since the article was written, so if you're confused by that, you're just missing context, and that's OK.

As for "anti-JWT" arguments, I've made them separately from the argument of Sven's claims. JWT is an error-prone cryptographic design. I wrote a replacement standard called PASETO that doesn't contain these foot-bullets. I still don't recommend people use PASETOs for sessions!
If a company forces two factor authentication, people will go to a product without it, because it's easier. It's easier to blame the product than bad security practices because no one is getting trained on these.

I think the real solution will be for Android and iOS to eventually have 2FA so integrated that any app can use OS APIs to implement it.
# HackerNews Post
Knotel | multiple positions | New York, NY | onsite | Full-time | https://knotel.com

Knotel is a fast growing commercial real estate startup that is inventing new ways to get things done in a traditional industry. Led by veteran founders, Knotel creates custom headquarters for companies without any of the headaches. Whether for 20 or 500 people, for 6 months or 6 years, Knotel provides businesses the flexibility and design they need in office space so they can focus on their work.

Most companies no longer maintain their own server hardware because AWS offers more flexibility and obviates the need to have hardware on-site and IT folks managing and maintaining uptime. At Knotel we think we can provide something similar for office space -- allowing companies to have the ability to scale up and down like cloud servers and freeing them from the responsibility of managing space by having to find people to take over their long leases, do space build outs, hiring their own with facilities management, etc.

As a result, we have a ton of interesting tech challenges all up and down the stack. We are working on a canonical data model for storing all of the information on spaces so we can increase operational efficiency and transparency across the company. We are building internal tools to increase our efficiency as a company. We are rolling out a data pipeline and ensuring all data flows into our data warehouse so everyone across the company can report on their key metrics. We are integrating with hardware in the physical space to track information like usage, temperature, and we are figuring out solutions for smart access control. We're looking to use computer vision to understand office utilization and flow within the office.

In brief, we have a ton of interesting problems to solve.

We're growing our engineering team in NYC significantly, starting with some key roles.

Today we're hiring a whole bunch of roles:

- Lead Full Stack Engineer https://grnh.se/91ad31da1
- Data Engineer https://grnh.se/d5c41fd31
- Senior DevOps Engineer https://grnh.se/e43371b81
- Full Stack Engineers https://grnh.se/a0d117a21

Any questions, feel free to email me victor [at] knotel dot com
Why you should avoid ORMs (with examples in Node.js)
Thanks for sharing this link. That's a really good essay!

I had not read it before writing my post, but it definitely looks worth linking to.
Tarot is one of my hobbies.

When done properly and
with responsibility, it does not claim any accuracy when it comes to telling the future.

It's a tool that you use to have deep and meaningful conversations. The cards are loosely similar to Jung's archetypes, among other things. Modern tarot is an anachronistic melting pot of many philosophies and concepts.

You simply use the cards to investigate a situation. You may discover someone's fears or hopes through one of those conversations. You can then use this information to help them plan out their future. That's pretty much it.

---

For example:

Say someone asks you about their career and you pick a card that means "shyness" at some point. The conversation then focus on the concept of being shy. Is this person shy? Could their shyness be the thing that make their work life harder?

If the answer is no, do they have someone at work that may be shy? You then talk about that.

If the answer is still no, could it be that they should be more shy? Is this person too bold? You ask this and the person gets defensive about themselves. A good reader will be able to notice this and then shift the conversation on that.

Through this discussion, they tell you that they might be too brash about one of their employees. You can then help them figure out a plan for the future, a plan to apologize or simply be more emphatic about that employee. But this person come up with the plan by themselves. You simply facilitated this discovery.

---

In short, it's a tool that get people to open up to you. Some people abuse of this. They give dates, prophecies, claim truths. They pick up on the points where the person they read for gets defensive and then use this information to emotionally blackmail them.

A good tarot reader is a good listener. You should not make any claim, you are not a trained therapist. Tarot readers should allow people to discover themselves without forcing anything. They should never say "you are x and need to do y before z happens".

(This is going to be controversial on HN. Keep an open mind and be polite. I am not a professional tarot reader and decline reading for people most of the time because of the liabilities that come with it.)
Scribd | Technical Engineering Manager - Search Team | San Francisco | Onsite | VISA

Scribd is a reading subscription that gives you access to the best books, audiobooks, magazines, and more. Our mission is to re-imagine the way the world reads. We are one of the oldest YC startups (YC ’06), operating one of the largest Ruby on Rails sites.

We’re looking for someone who is experienced in leading, coaching and mentoring software development teams that deliver stable, high-quality software. You have a strong technical background and are able to contribute to planning and design discussions, and believe in building teams and practices that scale. You can motivate and instill a strong sense of ownership and pride in your team. You know and care about software engineering standards and methodologies. You know how to make this team shine and by extension, all of Scribd.

We are a small team which means you can have a ton of impact and bring in your own ideas. Scribd has a very friendly, engineering-driven company culture with great perks for employees. We are ambitious but at the same time we value a good work life balance. In general we care way more about your personality and hacking skills than what languages you’ve used so far. We have hired a bunch of people from these threads, including myself. If you have any questions you can reach out to me directly at nikos at scribd.com or better yet apply directly at https://www.scribd.com/about/engineering
> there are valid uses cases where JWT makes sense (it isn’t categorically “bad” as the author tries to show).

The author does sound negative, but doesn't claim JWTs are categorically bad; he actually mentions cases where JWTs are useful: when they are used as single-use tokens. The author claims JWTs as sessions are too problematic to be useful.

> I’ve seen some pretty terrible security issues in both JWT and framework-provided session management libraries.

It seems to me the author is arguing JWTs (used as sessions) are more error prone and less battle tested than traditional session management. So if you've seen terrible security issues...
Yes but you're missing an entire chunk of context. The problem mentioned in this article is saying it's bad that you can't invalidate a JWT WHEN using them for authentication and/or authorization. This makes it impossible to do things like disable/kill a session that has been deemed hostile or dangerous (like a stolen account).

Now to build on this, good defense-in-depth can help here. For example if you use JWT only for authn but kept authz 100% server-side. You could then revoke the users access to everything so that the blast radius is confined. The bad actor could still authenticate into the system but would not have access to much or any resources.
No, because they don’t have that brilliant touch screen.
An update that has not been added to the article yet due to a lack of time: even if you do have a valid usecase for stateless tokens, you probably want PASETO[1] instead of JWT, due to the inherent cryptographic design flaws within JWT[2].

I'm probably not going to engage in the discussions on here this time, as it was an incredibly mentally draining experience last time; the vast majority of arguments were either already addressed in the article itself (which the commenters clearly had not read and understood in full), or argued against a misrepresented claim. It got so bad that I had to dedicate a whole second article to it[3].

If you have a genuine question or concern about the article rather than an Angry Internet Comment, feel free to e-mail me; my contact details are at the bottom of the article. No guarantees on response time as I'm juggling a lot of other plates at the moment, but I'll eventually get around to responding :)

EDIT: Another addition... this presentation[4] gives some insight into the history of JWT-for-sessions and why it became so popular. A spoiler: it wasn't for rationally-technical reasons.

[1] https://paseto.io/

[2] https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba...

[3] http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...

[4] https://youtu.be/GrLtOjCTB1s?t=1h2m44s
Citus Data | Software Engineer | Waterloo, ON, Canada / San Francisco, US / Amsterdam, Netherlands | Full-Time Onsite | https://www.citusdata.com/jobs/

We're looking for software engineers on the database development team which is responsible for development of the
Citus extension and related tools, and providing custom solutions for customers. Programming is done primarily in C,
but without all the usual messiness thanks to Postgres' elegant internal APIs. We also build tools to help customers
in whichever language is appropriate. If you're interested in working on distributed SQL, high availability, distributed
transactions, seamless scale out, and other parts of a distributed database, and you're excited about working in a distributed
organisations with engineers from companies like Amazon/Heroku/Google/Uber then Citus might be the place for you.

To see our other positions visit: https://www.citusdata.com/jobs/

Apply by sending your resume to hadi@citusdata.com or imagine@citusdata.com.
Have you considered buying a small laptop???

I use my iPad purely for consuming, and the laptop for all that you mention.

I do agree that there is a gap between the two though, an Apple product similar to the Microsoft Surface (pro). But I think this is a separate product to the iPad.
Flickr's stupid front end is what turned me off from them in the beginning. I built my own sites and hosted my own photos because it was cheap and easy.
Why call somebody on the phone when you can write them a letter?

> the true value of social media is as a channel for advertising?

That's probably too narrow. The value for me would be as a channel of communication.
It is not the toaster company's responsibility to make sure no one gets in your house and puts a fork in your toaster and leaves it running.
The article wonders (in the 5th-to-last paragraph) if a different kind of rejection might help reduce the number of people who turn into cranks. Sometimes they have an idea and it seems like they can't communicate it, so maybe just saying "I understand your point even if I think it's wrong" could help.
I don't think that enforcing the arbitrary restriction of views and opinions is the correct path to the morality you accuse them of being without.

Once upon a time, Copernicus and Galileo would have been viewed as "nutty conspiracy" theorists, the latter of whom the church tried combat, purely for having different views.

'First they came' and all that...
Yes, and this is the part I can't seem to figure out. I think it's more of a personality/networking issue.

Right now I have an MVP of a function as a service platform; a general purpose development tool. I'm thinking meetups are the best bet, just to meet people, ask questions, and listen to pain points. But that alone is a skill set that needs to be cultivated; asking the right questions, not coming off as pushy, being self confident, and finding the right events.
SEEKING WORK - Remote

Location: Europe

Remote: Yes, preferred

Willing to relocate: Maybe

Technologies:

- C, C++, Perl, Shell, PHP, Lua, Java...

- HTML, CSS, Javascript, JQuery

- SQL, PostgreSQL, Oracle, MySQL, DataWareHouse(DWH) and others

- Web Scrapping, XSLT, Extract-Transform-Load (ETL), Fulltext search (SOLR)

- Nginx, Automation/Ansible, IP Networking, Distributed systems, High-Availability systems...and more

Github: https://github.com/samsk/

OSS Projects: https://devel.dob.sk/

Language: English, German

Email: ja.hn3[at]mailnull.com or https://dob.sk/hire-me/

I'm a Linux/Unix C/C++/Perl/... Full-Stack developer (contractor/freelancer) with over 15 years of experience in various technologies, open source integration, system administration (DevOps), monitoring, etc...
Being able to access the camera remotely given the correct password is absolutely within the behaviour range that users are told about. It's the entire point of the product. Do they want remote access or not? If so, then it's the user's responsibility to provision that access appropriately. Passwords and 2-factor might be too complicated for some, but what else do we have?
Can anybody recommend a tutorial or book on how to do Authentication properly? Say for the usecase SPA + REST API.

If I google quickly I mostly just find tutorials that turn out to be ads for some 3rd party service. Or other beginner tutorials that don't seem very trustworthy.

I feel like I'm missing something, since this should be a very common use case for most (web) apps.

(Bonus if it also covers User Authorization, i.e. different roles that are allowed to do things or not.)

Thanks.
Permutive (YC S14) | Software Engineers | London, UK | Full-time, permanent, on-site, eligible to work in UK

Permutive is the simplest, most efficient way to integrate data-driven models into your product.
We're a B2B SaaS company built on top of an innovative real-time data platform. We have product–market fit and customers that love us, and we're growing rapidly in Europe and the US. We raised a $10M Series A at the beginning of the year and have received funding from some of the world's best investors, including Y Combinator.

Everything we build operates at scale: our platform processes billions of requests a day across hundreds of millions of monthly end-users. We're developing a next generation data platform for a world with a trillion devices, and we think applying functional programming techniques like compositionality and type-safety is the best way to build these massive distributed systems.

You would be joining our core backend team on-site in London, working mostly with Scala and 'big data' ecosystem technologies (our full stack is below). We're happy to talk to people with a wide range of experience—from straight out of university to those with decades of experience—but you should have a genuine interest and preferably experience in FP, distributed systems, and stream processing.

Languages: Scala, Haskell, Elm

Libraries: Cats, Cats Effect, FS2, http4s, Shapeless, Circe, PureConfig, pipes, Servant

Technologies: Kafka, Kubernetes, Terraform, Bigtable, BigQuery, Beam, Postgres, Google Cloud Platform

If you're interested and eligible to work in the UK, please email me (co-founder and CTO) directly at tim@permutive.com
I'll leave that here:

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC48023/

"This congruence among multiple lines of evidence strongly suggests, in contrast to traditional and current classification, that animals and fungi are sister groups while plants constitute an independent evolutionary lineage."