skysight-inc/HackerNews huggingface dataset:
Hey there, I'm involved with Dataquest and we have a Pandas and NumPy fundamentals course where we dive into more intermediate concepts like vectorization, key data structures, and the key functions.

https://www.dataquest.io/course/pandas-fundamentals

We use a similar approach to the OP. Lots of diagrams and visual aids and you always work with a real dataset.
I've noticed you keep making posts that boil down to 'I do/am/believe <x>' without it offering much relevance or insight to the discussion. It seems like you're just live blogging on HN. I'm very curious what your reasons are for doing so.

EDIT: I'm honestly curious. It doesn't bother me too much, and I'm sure I've made comments that I thought were valuable but in hindsight were probably just me wanting to be present. It's mostly the consistency of such comments from you that fascinates me.
Only if the law can prove beyond reasonable doubt that a crime happened, which is often difficult and why it makes sense to metaphorically secure the premises through an internal HR process as well.
Serious question: I've tried to use Pandas for some data analysis for my small business. Data sets are on the order of 10,000 data points or less. After struggling for days with Pandas, I've begun to wonder if it wouldn't be easier to code the analyses in raw Python. I wouldn't mind taking longer to complete the task at hand if in the process I was acquiring skills that will pay off down the road, but I wonder if Pandas isn't so esoteric and difficult that I may never reach the point that I can cash in that investment of time and effort as long as I am only a casual user.

In contrast, while I'm not an expert in JS or Python, I find that time spent struggling with those technologies pays dividends since the lessons learned make everything I do in the future easier.

This is highly subjective of course, but in your opinion, should I keep fighting with Pandas? Is it worth it?
Not after I have a Faraday cage painted onto mine. Inconvenient? Sure, but totally worth.
The Vulnerabilities of Our Voting Machines
So all sides trust the government except for the ones that don't
Turning off or modifying automated systems in any large device - buses, cars, airplanes, centrifuges, stadium roofs - would have potential for massive violence/destruction.
I remember my older sister verbally relaying stories from Jin Yong (金庸) to me when I was very young. These stories contributed greatly to my love of reading growing up.

An archetype form his stories that was formative to me is the diligent but dull-witted hero. I was never the smart kid in school. Yet, I never let go of the belief that hard work will ultimately triumph overcome lack of intelligence. I can't adequately describe how influential it was to grow up under Jin's writings. I am grateful for it.

Later on in life, after coming to America, I continued my love for reading with English stories. Fantasy and sci-fi were my favorites. A teacher in middle-school recommended The Hobbit, and somewhere along the way I learned about Chronicles of Narnia and Ray Bradbury. Everyone of these English authors colored my life in significant ways.

I have children of my own now and I read to them every night, even though my eldest can read on her own. It is just important to me. My eldest is extraordinarily creative. She often come home with stories she wrote and I am simply awed by her passion for storytelling. Sometimes I fantasize that she'd be as influential as Jin or Tolkien to future generations of children. If I can only be so lucky.
Kill Uncertainty: Build a Strong Value Proposition
Thank you! (Disclaimer: Blog author, CEO & Chief Geek here). I clearly believe, deeply, that focusing on photographers who care about photography is the right path forward, and I'm excited to see others feel that way, too. Please feel free to ask any questions I might be able to answer, and thanks again.
I really like this. I want to have an honest relationship with a service provider. I pay them for their service and they don't steal my data or reuse it in any way.
Corporations are made of people.
JWT is an authentication token - it isn't session state. Session state changes during the lifetime of a session. Whereas the authentication token does not - other than for renewals. Overloading the authentication token to also store unrelated domain concepts such as shopping basket items is a gross abuse of its purpose. Given that generating a JWT token is computationally expensive I really doubt that many people are doing this like the premise of the article suggests.
"Christina Hoff Sommers does not agree with my positions on issues therefore is biased and cannot be trusted, compared to people who do agree with my positions on issues, who are not biased and can be trusted."
Except cookies are quite literally perfect for that - set the expiration to 30 minutes from issuance and it will automatically be expired with inactivity. Or bumped on activity.
This is changing. Slowly, as it seems to be mostly a generational issue.

The younger scientists, current PhD generation and a little up are all fed up with closed source/private data as there are no enough bright examples how good open source/data can work out.
Raspbian isn't 'bog standard ubunutu'. The beagle bone black on the other hand does run bog standard everything. The right tool for the right job, the rpi is amazingly cheap and disposable for hardware projects. It is not a good machine to teach computers on because it's architecture is pretty odd.
Sell the patents to another shell company for $2, rinse, repeat every time you lose a lawsuit.
And the ones that don't, have not stated their position in this discussion.

So all sides presenting in this discussion, trust the government.
I use Radicale and find it great, but there's no UI, so you need to use whatever client you want that supports CalDAV (I use Lightning and the calendar on my phone). Lately I've been liking Nextcloud a lot, and that's a one-stop solution for lots of things, so nowadays I would recommend that if you have a home server or want to pay someone to host it.
And how is that better than using sessions in the first place? What is your gain?
Why would a competitor be better at hosting mongodb than mongodb company itself?
As a daily user of pandas for a few years now, I really must suggest that anyone looking to use it for serious data analysis familiarize themselves with the Split/Apply/Combine paradigm [0].

Lots of data munging has been enabled or sped up by judicious application those concepts.

[0] https://pandas.pydata.org/pandas-docs/stable/groupby.html
I would like to know what you mean. “Invalidating the client” seems almost nonsensical since you don’t control the client.
Hehehe...yeah, happens sometimes. Thanks for catching that, fellow serf.
Yep, that was one of the original ideas with using LLVM. The actual runtime that's needed is pretty small and the code optimizes well, so the output ends up being very close to if you'd written the code in, say C++, yourself.

But that said, I haven't actually gotten to writing the 'exporter' yet (up to this point I've mostly been focused on usability and stability), so I can understand that it's not entirely clear.
Because MongoDB is no longer open source. It is a sham license that says it is open source, but isn't, forcing pretty much everyone to use the proprietary license.
I promise this won't happen. I hate customer-hostile business models. (Disclaimer: Blog author, CEO & Chief Geek here)
I've been on the other side of this too often too. Sales selling things that don't exist yet, promising conflicting or impossible features and of course a ridiculous deadline.

If you're doing bespoke work, sure you wait for a customer to define what they need. But if you're working on a product, then what a single customer wants is not very relevant. You build something that you think the market wants (based on market research, gut feeling, whatever) and then try selling it. Doing it the other way around is the definition of vaporware.
The author glosses over this but what they mean is that you can set the HttpOnly flag on cookies to prevent them from being accessed via JavaScript.
I did that and I am happy about this announcement b/c I had lost faith in Yahoo a while ago and Verizon deal sealed it for me. I have over 80K pics there and no easy way for me to delete them, now they will do it for me.
Well your use case is exactly what they said that they didn't want.
How about standardised bands for competency? E.g. a software engineer level 3 step 2 has mentored three people, been the tech lead/written the OKRs for a 6-month project, and has X years of experience on other projects (in the earlier levels)?

Then it would be a simple HR policy to assign that engineer to whichever compensation band covered those levels when they joined a new company.
OAuth access tokens? The difference being that JWTs contain information directly, as well as an access token to hit any APIs, while an access token contains no information on its own - thus solving the revocation issue.

Now I don't think anyone really uses JWTs for API authentication, or they should not at least. APIs should still be gated by access tokens.
Don't forget the dependencies :).
Where did I say something about 'trust' and 'government'? Seriously, I don't get the connection.
Disclaimer: not a front-end dev.

I'm not sure what the issue is with a simple session token, to be honest. OWASP have guidelines on this that cover the bases pretty well, I think.

Store hashes, not tokens directly.

Expire them server side.

Don't accept user input (within reason). You generate and offer the tokens, you know what they look like, you can bounds check / sanity check appropriately.

Perform some additional checks as necessary (e.g. invalidate a session if remote IP changes).

If you have more security critical parts of the infrastructure, require re-authentication and more short-lived sessions for those. The obvious example would be how Amazon pretend you're "logged in" until you go to click My Orders, then you get auth gated.

I tend to think that people over-complicate this stuff a lot as a premature optimization for scaling.

A simple python script backed with some DB will do hundreds of hits a second to an auth service without really trying. If you need more than that, optimize. If you need more than 10k hits a second on a regular basis then you're probably at the point of hiring someone who knows this stuff.

Just my 2c.
Yes, seriously. How to invalidate is exactly what is being discussed.
I do store all my family fotos on Flickr. I just pay for a pro account.
Crypto could also become one of the biggest contributors to climate change, since it’s literally just wasting as much energy as possible to make money.
Doesn't the author cover this in their rebuttal (http://cryto.net/~joepie91/blog/2016/06/19/stop-using-jwt-fo...), "Your blacklisting/revocation server goes down, now what?".

Everything from there goes to "Congratulations! You've just re-invented sessions (only with a less battle-tested implementation) and gained nothing in the process"

(Sarcasm is from the author's post, not mine!)
As someone who works in a similar space to what Brave/BAT is trying to do... I would like to point out that it’s very easy to sign people up to receive payments in your scheme.

It’s another thing to (1) get users to actually use your system the way you want them to and (2) get publishers to base their revenue model, at least in part, around your system.

I am not really impressed by these numbers because they do not include any usage statistics of BAT itself and there are no examples of it actually helping publishers.

That said, they are setting out to do something very difficult so we should respect what progress they have made.
It it could be essentially the same procedure as splitting of Standard Oil, then, obviously it is good idea.

Why should an ordinary joe like you and me care about FAANG shareholders?
> you'll accept the screen is edge to edge because it very like one that is

I think that's the core of the dispute here. The screen on this iPad is nothing like a screen that's edge-to-edge. It's surprising and confusing to see it described like that with such a clear thick bezel in all the images. I and a lot of other people in the comments here don't accept that this screen is edge-to-edge.
Many in the comments are curious about blacklisting JWTs. No, you don't need to put the whole token on a blacklist. Give your tokens reasonably unique JTI claim[1] and put the affected JTIs on the blacklist.

The benefit of JWTs is that token blacklists are usually much shorter than hypothetical token whitelists.

[1] https://tools.ietf.org/html/rfc7519#section-4.1.7
> They'll think it's normal, which is the real tragedy, but that's been happening for generations already. Your idea of normal is not as rich as your ancestors'. Wasn't North America abundant with wildlife when the Europeans arrived?

I'm not sure what you mean. I consider my life to be substantially richer than my ancestor's lives. I live in Europe, not North Americal, but yes there was more wildlife around a couple of centuries ago. It would be nice to have that again, but i'd settle for something like the current fairly poor situation it it meant that my kids and their contemporaries don't have to risk being made into refugees by climate change, or face a future of water/food/energy shortages, failed states and frustrated potential.
If an attacker can read the user's localStorage you have much bigger issues to worry about: XSS, physical access, no TLS, etc. With any of those, the token is the least of your concerns; an attacker can make API calls, read the data, etc anyway, no matter if its JWT or sessions.

So, IF (which is a big if) you implement everything correctly then you have to do two "extra" steps with each tech:

- Blacklists (or Whitelists). You _do_ need these, because you want users to be able to logout. Then it's a lot more like sessions... oops.

- CSRF protection for sessions. These become trickier to manage in SPA and just become sort of a "token" that you need to refresh on each call... oops.

It seems that the shortcomings of each technology makes it to lean towards the other. The good news is that both of them are theoretically secure, the bad news is that to reach that level you have to do a lot of work (on both!) with a lot of room for error.

That is why I personally prefer JWT with SPA and CSRF with traditional servers, since the amount of new code that I have to write is a lot lower so chances for error are quite lower. For instance, see the (very brief) documentation of the CSRF for my project server.js: https://serverjs.io/documentation/router/#csrf-token . If I had more time I'd write something similar for JWT.
What do you base your accusations of Xenophobia on? I don't think anyone would object to Swiss, German, US, Australian or Japanese immigrants... The issue is inflow of immigrants of different cultures, who don't assimilate - and it's not unreasonable to judge those cultures as inferior and unwelcome (in the EU we don't force our women to wear masks and stone them for infidelity...).
> What would you break Apple up into?

Apple the device manufacturer and iTunes (or whatever) the streaming content service provider.

> Or Facebook?

Facebook, Instagram, WhatsApp.

> I guess you could break up Google

Alphabet makes this easy. YouTube, Cloud Compute and the other things.

> it's basically a natural monopoly

Natural monopolies don’t have to acquire potential competitors to protect their flanks. Facebook minus Instagram would be very different today.
For comparison, here is symbolic derivatives in C. I wrote this in 1990 for school project:

https://github.com/jhallen/joes-sandbox/tree/master/x/xquiz

I need to make slides and a better write up for it, but the program is a math quiz with equation editing and graphing capabilities for X. It includes a simplifier which will take derivatives if they are in the form: D(x^2)/D(x)

The simplifier also combines terms, reduces fractions, etc. I was shooting for something like Macsyma.

The derivative taking function is
here:
https://github.com/jhallen/joes-sandbox/blob/master/x/xquiz/...

Equations are parsed into LISP-like lists, defined in box.h. There are list nodes, numbers and symbols. They are allocated in aligned pages. To distinguish between them, you look at the page header. Some of the classic LISP implementation used this same technique- I was interested in it at the time, but wouldn't use it today.

As you type equations in, they are typeset in standard math notation on the screen. You can edit the tree by selecting any part of the equation with the mouse. Once something is selected, you can type in a replacement, or click simplify, distribute, or factor. I had fun correlating mouse coordinates with tree locations.
In fairness, though, the 1812 ouverture IS a pretty impressive piece to listen to, if it is properly recorded and reproduced.

While my setup is somewhat (cough) less impressive/over-the-top than the one referenced above, there's no denying listening to a proper 1812 is a physical experience.

I'm partial to Kunzel's recording with the Cincinnati Pops - those cannons are LOUD. (Better be careful not setting the volume too high or you're likely to find yourself a couple of woofers short afterwards.)
I have been using Flickr to archive my photos since 2013 when they announced a 1TB limit for free users, and have been paying them $50/year since 2016 when they limited availability to Pro users for their first-party auto-upload tool ( http://flickr.com/uploadr ).

It did seem like the 1TB limit was too good to last when it was announced 5 years ago.

Still, it's a relatively inexpensive extra archive for my photos (400GB) that supplements other backups. The archive is sorta searchable and kinda good for sharing with family and friends.

I haven't really used their social or community features (the Explore experience, the magic donkey, and the pandas are all alien to me -- https://www.flickr.com/photos/thomashawk/361974994 , http://code.flickr.net/2009/03/03/panda-tuesday-the-history-... ).
Yes, this is problem, but two 200W lasers[0] separated by thousands of kilometres are able to filter out noise created by atoms or electrons easily. Moreover, 200W of energy applied to single atom will put away it from path of laser very quickly. At such powers and precision we may need to take into account flow of neutrino. It's possible that distant event created blast of neutrinos, which affected speed of light in vacuum.

[0]:https://www.ligo.caltech.edu/page/laser
https://portswigger.net/blog/web-storage-the-lesser-evil-for...

(It not only explains what others have said about httpOnly, but it also goes more in depth on the tradeoffs between the two.)
Google offers are some of the best for putting pressure on other companies.

I am currently at another FAANG though, and may not leave my company ever, even if it would likely up my compensation.
I really like Flickr. There's a wealth of beautiful images, great groups (even though a lot of the ones I used are dead/dying), and I really like that I can upload uncompressed images. A lot of what this post says rings true, and hopefully they can right the ship on the engagement front, because right now it feels pretty dismal. When I post to Instagram, I get 20 times the engagement. I'm not sure how they fix that, but I'll stay on board as long as they keep trying to improve things. I'd have no problem going pro if I hit the 1000 image limit (right now I'm at 574).
Wouldn't the Eru's resurrection of Gandalf count as a pretty clear example of the Universe intervening to make sure that pure good will win out in the end?
I've watched Laughing in the Wind (2001, 4 seasons with 10 episodes each) but with English subtitles as I don't speak Chinese and have to warn the other poster that it's availability is extremely limited last time I looked.
Surprisingly enough, they have a data export on the account page. I'm not sure when this was added but it was always a pain point for me and a reason I stopped paying any attention to my Flickr account. All it took was a drastic change to make me re-check my account!
This was a really great post!

Quick question: What does the decoder attend to right at the start? I still can't figure this part out. Perhaps I am missing something very simple.
I bruteforce a password for your JWT-enabled app. Then I have a token. Copy the token from my browser ( usually just open Network tab at the inspector and copy the headers for the request ). Then I store the token at my server and make it execute a request to the app on intervals to prevent from expiring ( reissue ) the token.

How can you invalidate my server now?
Growing noise in the ocean can cause dolphins to simplify their calls
The landing page for the announcement has a little more detail: https://www.flickr.com/lookingahead/

> Free members with more than 1,000 photos or videos uploaded to Flickr have until Tuesday, January 8, 2019, to upgrade to Pro or download content over the limit. After January 8, 2019, members over the limit will no longer be able to upload new photos to Flickr. After February 5, 2019, free accounts that contain over 1,000 photos or videos will have content actively deleted -- starting from oldest to newest date uploaded -- to meet the new limit.

I have a Pro account so maybe it's different, but I have a "Request my Flickr data" button in the bottom right of my account page: https://www.flickr.com/account

And unless something has changed recently, IIRC, Flickr had a very generous and fairly easy to use JSON API. In the past I've been able to bulk download my ~10,000 photos with just a few calls: https://idratherbewriting.com/learnapidoc/docapis_flickr_exa...
Do you have more than 1000 photos that are portfolio level quality?
I support this but I also wish other companies would be under the same scrutiny as Google. I've been at companies where women not only were paid much much less but also more or less objects that were openly treated as such.

There would be management meetings about rating the sexiest coworkers and who could lay down the most (obviously not a single woman in whole of management and they had no chance of moving even close to it in their career). All sanctioned from the highest level and not a single person would dare to question it. I was not actively participating but also part of the problem since I didn't say anything.

This was not even done in secret and more or less public knowledge. The communication from management had a lot of sexist jokes and pictures and anyone questioning it "had no humor".

Mind you, this was not a tech company per say and I believe the further you get from tech the worse it gets. I think it's sad that the huge problem affecting 99% of women gets reduced to a single company which probably is one of the few in the world that even has a code of conduct against this stuff.
It's Too Bad Electric Scooters Are So Lame, Because They May Be the Future
Tarot reading is discussion of ones life with the aid of a random number generator (the shuffled deck) to overcome preexisting maladaptive interpretations and cultural assumptions.
Love this intro! All of the popular dataframe oriented tools (tidyverse, pandas, etc) all require familiarity with vectorization and thinking with related mental models. I'm involved with Dataquest Labs and we teach data science interactively in the browser. We're pretty big believers in using diagrams and visual aids to help people learn these concepts as well.

We've had a pandas course (https://www.dataquest.io/course/pandas-fundamentals) for a while and we just launched some R courses that teach a lot of vectorization (https://www.dataquest.io/path/data-analyst-r).