skysight-inc/HackerNews huggingface dataset:
Stuart | Backend Engineer | Paris, London, Barcelona | REMOTE or ONSITE

Stuart is an on-demand logistics company with a B2B software platform. We have a fleet of couriers (mostly bicycles, but others too) delivering a range of goods and foods in cities across France, Spain, and the UK. Our platform is a streaming geolocation service that connects businesses to couriers via a smartphone app, web dashboard, and API.

Customers include Zalando, Nike, McDonald's, KFC, Just Eat, Ocado, and Monoprix.

We're hiring for roles across the engineering department: product, backend, QA, and data science.

Specific roles and application forms are here: https://stuart.com/jobs
True, and that works well when using the on screen keyboard but not when you sing a detachable one.
> 1. Support a "Log everyone out" function by storing a simple version number in the JWT. If the version constant in your app is different to the number in the JWT, it is invalid.

If you've got the iat property, you could just use that. i.e. anything issued before x time is invalid.
> But what happens with the GDPR if I, a European citizen in Europe, access this website (blocking EU IP addresses) using a VPN?

Then everyone involved (except the lawyers, who will make out quite well) can risk getting wiped out as the EU’s extraterritorial application of privacy regulation and the US’s civil and criminal laws on unauthorized access combine into a firestorm of transatlantic litigation.
Tribune Media would be subject to fines if they ever tried to do business in Europe.
Show HN: Watch YouTube together. Shared player
I too see this as an advantage; sometimes I want to develop and tinker, sometimes I need to to get work done that does not require that freedom but does require: stability, focus, long battery life etc and for that the iPad pro with keyboard is perfect (in my opinion). I had a Surface Pro and for that ‘just work’ kind of experience it sucks in my experience; updates, crashes, battery life etc. It turns out 80% of my work can be done really well on the iPad Pro and I indeed find myself using it far more than my laptop these days. I think a combination has to screw up that experience as it has for all other more free devices besides maybe Android but there is no iPad quality hardware for Android.
>> A detachable keyboard with touchpad (far better ergonomics than a touch screen when typing at a desk)

I’d rather Apple sufficiently improve the software keyboard so we don’t need a detachable hardware keyboard. There are keyboard cases for the iPhone but they are still niche because the iPhone keyboard has always been good enough.
I've started to use http://gohugo.io/ and like it more than anything I've used earlier, including Jekyll.
This entire protest would have generally been a non-event if the company hadn't sent out a memo telling managers to accommodate people who want to participate, ensure there is no retaliation or penalty, be flexible with schedules, etc., effectively advertising the event to everyone in the process. So then it looks like employees are being unsupportive of their co-workers if they don't participate. Which sort of shuffles the understanding of a "walk out" to be a far cry from the sort of thing that happened in the union days, and puts this firmly in the Just Google Things category, where even protesting the company becomes an activity that the company officially supports.
SEEKING WORK - Remote, San Francisco, Washington D.C

I'm a full stack developer and designer.

I'll build you a minimal lovable product for a fixed $9K and in 4 weeks.

For iOS apps, I use Swift. For web apps, I use Ruby/Rails, JavaScript.

To see some of my recent work:

https://breue.com/

https://dribbble.com/zachvanness
in so far as ssh is just one of dozens of commands that the girls learn on the command line, it's perhaps not.

in so far as it makes them realize that computers are discrete entities that are networked and that this is what the internet actually IS... it's priceless.

The first time we connected to a remote machine in a different state it BLEW THEIR MINDS. One of them asked if it was EVEN LEGAL :)

It's a single command, yes, but it's also the pivot point for a whole unit on remote access, networking, IP addresses, etc.

So consider SSH shorthand for that whole subject.
Boston Airbnb regulations cause owner of apartment building to make it a hotel
Interesting. This is a grave argument against using those services. Thanks.
Rescale | San Francisco | ONSITE | https://jobs.lever.co/rescale

Rescale offers a software platform and hardware infrastructure for companies to perform scientific and engineering simulation. (We're an HPC Cloud Platform)

We are a Y Combinator startup with top investors: Jeff Bezos, Paul Graham, Marc Andreessen, Richard Branson, Peter Thiel, & a bunch of others. We have about 80 employees scattered around the world, with about 15 software developers all located in San Francisco. The company still feels small and everyone is pretty tight. Work atmosphere is fun & friendly.

We recently closed Series B ($32MM), just moved into a new office this week. All departments are hiring. It's exciting, a lot of opportunity, interesting technical problems to solve, definitely a good time to join. Devs that come in now will have the opportunity to have a big impact on the future of our company, our code & our culture.

We're currently looking for: Senior Backend Engineer, Senior Frontend Engineer, Senior DevOps Engineer, Software Engineer, Senior HPC Engineer, Data Engineer, HPC Engineer, Platform and Applications Engineer

Please check us out: https://jobs.lever.co/rescale
My understanding is that the password was compromised. It is well within expected behavior for Nest to allow someone with the right credentials to access the connected cameras etc. This isn't a matter of expecting the consumer to reverse-engineer their product and perform a security audit before allowing themselves to trust it, it's a matter of expecting the consumer to understand what credentials are.
Interesting. I guess the RPL however is as toothless as the AGPL when it comes to extend its scope to the provisioning software cloud providers use to run your AGPL-licensed software for their customers, which is the problem I believe MongoDB, Inc. wants to target.
The day Volkswagen briefly conquered the world
Company lied to consumer that this wouldn't happen. Then it happened. And you're blaming the consumer?
In the Loop – November 2018
> I suspect that the change is more to do with the cost of storage

I think you're right about that, but they did address it up front:

> Second, you can tell a lot about a product by how it makes money. Giving away vast amounts of storage creates data that can be sold to advertisers, with the inevitable result being that advertisers’ interests are prioritized over yours.

*

> I'm happy to accept that I'm not a user they can support for free. I like Flickr, wish it well, and am happy to pay for pro

That's great! And I want to say that I highly respect the maturity and understanding you demonstrate here. I wish more people adopted this attitude.
Funding Circle | Onsite London | Software Engineers all levels |Ruby, Clojure, Python, Polyglot approach

If you haven't heard of us try checking these out:
https://bit.ly/2xfbCG0)
https://bit.ly/2QwMH9A)

At Funding Circle we are developing a two-sided marketplace that allows small businesses to get access to the funds they need to grow.... Globally.

Building next Gen real-time systems with Kafka and Kafka streams.

Machine Learning software for, Anti Money Laundering and Risk Modelling to CRM systems and Automated Underwriting.

Scaling our core customer-facing platform.

Building a brand new Micro-service and Event-driven platform ready for global expansion.

Salary dependant on experience
Apply here: https://jobs.jobvite.com/careers/funding-circle-uk/job/oCCE7...
Thanks for the detailed info.

I was only glancing and saw the base pay.. Yes I agree contractor vs FTE has a lot of compensation differential beyond base pay.

Looks like you have a sweet setup right now. Congrats
Dia&Co | New York City | Onsite | Remote OK (within US only) | https://www.dia.com

Dia&Co is the leading personalized styling service for women who wear sizes 14+. Our business meets a profound need, and we are on a mission to democratize fashion — not only by providing easy access to quality clothing, but also by building an inclusive community of women who use fashion to celebrate their bodies.

To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/dia&co

Here are some of our open positions:

* Lead Software Engineer (Rails/React): https://grnh.se/eekdkocj1

* Lead Growth Engineer (React/Node/JS): https://grnh.se/dbe99a971

* Senior Software Engineer: https://grnh.se/eshew45o1

* Software Engineer: https://grnh.se/j3egdukt1

* Software Engineer In Test: https://grnh.se/6410c2f51

* Software Engineer, Data: https://grnh.se/e526msjr1

* Statistical Analyst: https://grnh.se/sirmilts1

* Machine Learning Engineer: https://grnh.se/k2r8iyqt1

* Director of Growth Product: https://grnh.se/a2c0405b1

Tech Stack: Engineering: Ruby on Rails, React, Node, Postgresql, ElasticSearch
Data: Python + Go, Docker, AWS services (e.g. Kinesis, Lambda, ECS, Fargate…)
Authy is pretty impressive in that regard, I used it for the first time with twilio the other day and was impressed.

Not affiliated with either company.
SEEKING WORK - Remote

I am Software Engineer consultant with 15+ years of experience.

Worked in various roles at Enterprise Clients in Greater New York Area. Some of the roles include Product Development, Enterprise, Software Engineering, Solution & Enterprise Architecture, Agile/Scrum, Full-Stack, Cloud Computing, Data Analytics & Delivery.

My Expertise: .NET Core, C#, Javascript, ReactJs, AWS, Cyber-Security, Asp.Net MVC, Asp.Net WebAPI, GraphQL, NodeJs, SQL

LinkedIn: https://www.linkedin.com/in/rasikjain/

Stackoverflow: https://stackoverflow.com/users/1993944/rasik-jain

Email: jainrasik AT gmail (.) com
Galaxy Digital | https://www.galaxydigital.io/ | Sr. Frontend Developer | 170k | New York, NY | ONSITE | Full-time

To apply or inquire about other engineering/developer roles send CV to techcareers@galaxydigital.i

Company Overview:

Galaxy Digital is the leading merchant bank in the digital assets industry. Through deep understanding and a wealth of experience, we lead our clients through the constantly evolving world of digital asset investments. Our expertise includes investment and trading, asset and portfolio management, capital markets, operations, and cryptocurrency and blockchain technology.

Role Summary:

The Front-End Developer position will be creating the design and implementation of software applications serving Galaxy Digital’s trading and digital asset systems. The developer will work closely with our Program Management team and various operational and trading business units to ensure timely delivery of high-quality software solutions spanning multiple technology platforms.

Skills:

• SME in JavaScript, including newest language capabilities (ES6,7+), performance tuning, and design practices.

• Strong foundational skills in React, Redux, and JS-related dependency and build tools (deep experience with comparable frameworks may be considered).

• Solid fundamentals in REST API integration.

• Comfortable building libraries and toolkits as well as standalone applications.

• Strong collaboration skills

• WebSocket/real-time communication experience

Experience:

• Minimum 3 years hands-on development experience with a Bachelors degree, working with relevant technologies with some in financial services or related.

• Financial Markets and/or crypto currency knowledge, particularly trading systems and exchanges, are a huge plus.
SemiCode OS, una distro de Linux hecha para programadores
> Perhaps we'd need to start over?

Maybe. But if we do, I'd love if there were allowances in the new design for creating isles where everything flies, and security is very low. I have two reasons for that:

One, security is - to some extent - mutually exclusive with capabilities. When everything is sandboxed and end-to-end encrypted, I can't inspect what a piece of software is doing, and I can't write code to make that piece of software do what I want. This flexibility is needed to make one's workflow efficient, and one's problems solvable (at least without waiting for someone else to solve them).

Two, hardening security has the distinct tendency for enabling vendor overreach and lock-in. The same techniques that secure your data from evil third parties can be used to secure "your" programs from you.
TELUS Digital | Full-Stack Developer| Toronto/Vancouver | ONSITE | Full-Time/Contract

Our team at TELUS Digital is spoiled. What you’ll find here is that our vibe is completely different from what you may see in a traditional office. There are no cubicles or seating plan, instead, we have teams of people working side-by-side creating something exceptional for our customers.
We use a range of technologies to get the job done: JavaScript and Babel (ES2015-2017) coupled with Webpack, React, Redux and other libraries to provide a modern, easy to use Javascript toolchain and smooth Developer Experience. A central Design System is used for styling and hosts shared components, while our RESTful APIs are built with Node.js powering our custom services. Quality is a primary concern and we test our applications at multiple levels with QA and Product Owners embedded within teams.
Take a look at our open positions:
https://www.telus.com/en/ab/digital/careers?linktype=nav
It shows opening for PM/Senior PM in Seattle (interested) but no description of job/etc.
Unfortunately the only additional authentication Nest offers is SMS base 2-step auth. You would think being owned by Google they would allow for 2FA.
Reddit has had mixed results with this - it entirely depends on the community and moderators. Some subreddits are much better managed than others.
So that was not the case for my brother; his numbers were significantly worse and he was on medication, before he switched to veganism and greatly improved. In the study I posted, the meat-eaters were in the study too so I don't think that bias exactly applies, though in general dietary studies are always difficult.

I think I've read the same books as you, and agree with much of what you say. I would love to see us switch all our cattle over to Allan Savory's methods, and if lab-grown meat works out, maybe some ranchers will survive by providing premium grass-fed.

I've also read a stack of the better-known low-carb/paleo books. It just didn't work out for me, my results were horrific. It does seem to work for some people. Regarding cavities, perhaps there are tradeoffs to every diet.

In any case, as I said above I don't think vegetarianism is a way to save the world. Lab-grown meat is what will help save the world. Getting off oil will also be a huge help.
Location: Minneapolis / Saint Paul, MN USA

Remote: Yes

Willing to relocate: No

Technologies: .Net, C#, Azure, Web API, SQL, Mongo, Elasticsearch, Javascript, React, Node, much more

Experience: 12 years FTE development experience, leadership roles, consulting services as well

I am looking for contracts up to 10 hours per week.

Resume: Please email me

Email: grjrojo at gmail
> you can tell a lot about a product by how it makes money. Giving away vast amounts of storage creates data that can be sold to advertisers, with the inevitable result being that advertisers’ interests are prioritized over yours. Reducing the free storage offering ensures that we run Flickr on subscriptions, which guarantees that our focus is always on how to make your experience better.

If one thing were to make me want to consider Flickr's services, this statement alone would be it.
If only you could plug an Android phone in desktop mode (Samsung's Dex or Huawei's projection) to power such a perfect mobile touchscreen and keyboard.

Android chips lag behind, but they're good enough for occasional development.
Years ago a teenager was arrested for "hacking" because he just Google'd the answers to Sarah Palin's security questions to gain access to her Yahoo account.
ThoughtWorks Technologies | India- Pune, Bangalore, Hyderabad, Chennai

We are passionate technologists who believe in the power of software and technology as tools for social change. We contribute to a multitude of open source projects. Primarily we are a Technology Consultancy Company. We look for zealous Technologists who are keen to learn on job. We value Object Oriented and Functional Skills. DevOps and Agile are a normal way of working here
Skillsets/Platforms/etc.: C#, Java, Ruby, Scala, AWS/GCP/Azure, Python, Node.js, React, Angular.

Requirement: 5+ years of programming experience.

Interview process: Phone interview, Take-home coding assignment, Pair programming interview, Technical Interview(s), Logic and aptitude tests, Cultural Interview.

More about ThoughtWorks: https://www.youtube.com/watch?v=MBqquBtwaNM

https://www.thoughtworks.com

Contact: siddhark[at]thoughtworks.com

Please send email with 'Hacker News' in subject line.
> freedom of speech

that's largely an American concept, along with the rest of your post. please stop assuming other countries are like the US, especially laws and legal systems. it rarely furthers the debate
Arch | New York, NY | https://archlabs.com | ONSITE | VISA | $100K - 175K w/ significant equity

Arch is an early stage NYC-based, Fintech startup in the alternative investment industry with paying customers. Our engineering team is a couple of MIT alums who were previously early engineers at successful startups that have since IPO'd. We are being advised by a founder/investor with two successful exits (who was also the eighth user of Dropbox).

We're looking to grow our three person team. Contact us if:

- Your favorite fruit in JavaScript is ('b' + 'a' + + 'a' + 'a') (Arch does not discriminate against apple or orange lovers)

- You think https://github.com/denysdovhan/wtfjs is interesting, but looks nothing like your code

Fullstack - https://angel.co/arch-4/jobs/375451-senior-full-stack-engine...

Frontend - https://angel.co/arch-4/jobs/375452-senior-front-end-enginee...

Apply above or reach out to jtrigg@archlabs.com
another interesting excerpt from that article:

If you read Larry and Sergey’s original paper that they wrote at Stanford, where they talked about creating a search engine, they specifically said that advertising was wrong and bad and it would inherently corrupt the search engine if you sold advertising.
> Since the blacklist is just a collection of random token IDs, it isn't sensitive. You can store it anywhere, including in memory in your web servers or in a distributed cache. You can wait during blacklist/token invalidation events until the newly blacklisted token has been propagated.

This is very dangerous advice. If you're advocating for the addition of a fast blacklist storage, you really haven't changed your previous pattern complaint, but the dangeous bit of your advice is implying that it's simple to store "anywhere" such as "in memory in your web servers."

That is a bad idea. If your authentication model is depending on an explicit stop-list to invalidate tokens, then you need to take the integrity of that data set very seriously or be at serious risk of credential replay attacks. A loss of integrity in this data store in unacceptable. Even some eventual consistency can be dangerous (but is generally accepted as a risk if the time envelope is acceptable).

It's much better (from a security standpoint) to have very short lived tokens and constantly revalidate. The revalidation cycles CAN be full database cycles since they occur at a reduced rate, and you can then have more sophisticated policies there without too much trouble.

> All of this is around 90 lines of python in my Django site.

I don't doubt it, but trying to scale your advice to a product or to an environment with actual concurrency opens up a lot of complications you're not considering.

JWTs are, by and large, just an inferior spec with too many brittle edges. You need to be really careful to properly implement JWTs in your environment. You're much better off either sticking to rich session tokens or using something like Macaroons.

P.S., not only is the phrase "black" list steeped in a history you may not realize you're invoking, but it's much less precise than the term "stop list". Please do consider this.
Tackle | Full Stack Developer, Engineering Manager | Boise, ID | REMOTE | https://tackle.io

Tackle builds a product that helps amazing software vendors like New Relic, Pagerduty, and Druva take advantage of the AWS Marketplace. We are looking for an experienced Full Stack Developer and an Engineering Manager to help us expand our existing platform so we can better serve our customers.

Stack Overview: - Infrastructure: AWS - Front-end: JavaScript / React / MobX - Back-end: Python / Flask / Zappa

The ideal candidate will be a self-starter who enjoys working independently and has previous experience working on a remote/distributed team.

Email jobs@tackle.io
The problem is that what I'm building is a function as a service platform, a general development tool. So developers/managers are the target audience. I think it's a matter of finding the “BANT” (budget, authority, need, timeline) requirements the article mentions.
It does sound like, per the other poster, I'll get asked a lot of front end dev questions , the kind that will be hard to answer since I have no recent front end experience (and the experience I did have was full stack anyway)
Why are checking against the DB here? Parent said a constant. You'd just check the constant value within the JWT vs the constant on the backend, and update the backend constant to invalidate.
Yes, we should prosecute all people who commit fraud for fraud. There are many people on both sides of Ponzi schemes who believe what they're doing is legitimate and isn't fraud.
> It doesn’t make sense to me that something which emanates outward can in any way cause things to move inward.

If it doesn't make sense to you, that's normal. It doesn't make sense to a lot of people. It's very unintuitive. You should probably make the effort to actually learn the math and physics behind it before just dismissing it, though.
Your analogy implies that compromised IoT devices are some rare statistical anomaly that nobody could possibly predict ever happening.
Truth vs. Social Justice
Classic hostility on HN. I'm out, I'll go find my tribe.
Please keep in mind, the compensation numbers are from employees that have typically worked for a couple years, have stock grants that have appreciated significantly, and that is a significant portion of their total compensation.

If you want to compare your offer, look at GOOG, AAPL, FB and what their stock value was in 2016. Use that share price to figure out what the employees that were hired in 2016 were offered in terms of stock, and compare your offer.

There is no magic to it. HR is just taking what they think they need to offer to be competitive, assuming a 10-20% annual increase in stock value, and making the offer. The primary reason why you see such high total compensation numbers is that tech stocks have done extremely well recently, which has put employees above their target compensation.
>We have seen instances where a small number of Nest customers have re-used passwords that were previously exposed through breaches on other websites, and made public. None of these breaches involved Nest. This exposes these customers to other people using the credentials to log into their Nest account.

Subtly, Nest did not actually claim that the attacker had a correct password. For all we know this instance was a breach.
yes we used a combination PCA for feature extraction and then SVMs and logistic regression for classification.