skysight-inc/HackerNews huggingface dataset:
CTRL-labs | many positions | NYC

Imagine the world where computers are natural extensions of thought and movement.

CTRL-labs dedicates itself to answering the biggest questions in computing, neuroscience, and design so creators can dream.

Our work to build a transformative neural interface spans research and challenges at the intersection of computational neuroscience, statistics, machine learning, biophysics, hardware, and human-computer interaction.

https://www.ctrl-labs.com/careers/

https://www.youtube.com/watch?v=5Z5aZK2C3ew
> All mass account hijacking attacks rely on bots that either emulate or automate web browsers, and Google has a technology that has proven quite effective at detecting these tools

It sounds untrue and short-sighted. Even Google provides the tools for anyone to automatically navigate in a javascript-enabled website with Chrome Headless. All this will do is to provide a short-term security before the bots can again perfectly mimic humans with JavaScript enabled, this time.

Most "mass bots" can be stopped by logging the access attempts on the server side, with plain old HTML on the client side.
Very interesting. If I understand correctly - this essentially solves the problem of each Electron application having to package the entirety of chromium with it.

However it comes at the cost of assuming the user already has chrome installed - as well as a more separate model between browser (UX) code and application logic.

I see this as being extremely useful for community tools that currently run on Electron (like iNav https://github.com/iNavFlight/inav/wiki). I'm hesitant to think it will be very viable for commercial products - but my instincts are wrong most of the time.

Ideally carlo would also be able to create a build target that bundles chromium with it, so that there is support for users without Chrome - and carlo will act more like Electron in that case.
Sensor Tower | San Francisco, CA | Full-Time, Onsite | https://sensortower.com | VISA

Sensor Tower provides key metrics for everyone involved in the mobile ecosystem. Whether you’re a mobile app developer, a financial institution performing mobile market research, or a large brand thinking about your mobile initiatives, we provide your one-stop shop for due diligence.

Learn more about our engineering culture here: https://www.keyvalues.com/sensor-tower

And check out our open roles:

- Full Stack Engineer: https://jobs.lever.co/sensortower/a421feb6-2c0e-4f1b-adb1-84...

- Senior Full Stack Engineer: https://jobs.lever.co/sensortower/c171234a-4906-46c3-b609-7d...

- Director of Engineering: https://jobs.lever.co/sensortower/5d633b40-e089-4b81-8f78-8d...

- Senior Software Engineer, Data: https://jobs.lever.co/sensortower/7442e664-c7ff-4221-8ac7-6e...

- Senior Data Scientist: https://jobs.lever.co/sensortower/7eb5e065-4107-4bc9-85b5-99...

We use Rails, MongoDB, Knockout, and Go.

If you're interested or have questions, email us! jobs [at] sensortower [dot] com
My wife and I are both millennials and all the time she'll be playing with a Snapchat filter holding her phone straight out, and I'll ask her why she's filming me. From the back of the phone, it's completely indistinguishable.
>>2. Support a "I need to logout user X function" by storing a blacklist of tokens in your RDBMS.

Again though, the whole point of JWT is to completely avoid server-side state management. The moment you store state somewhere (whether a list of valid tokens or a shorter list of invalid tokens) you have re-invented the concept of sessions, so why not use that instead?
On Cross-Site Scripting and Content Security Policy
On that track, if my server logs are an indication there are quite a few folks running private wars.
I think some of the problem is that people who use pandas don't necessarily know how to drop one level in programming. Like, if the file isn't a nicely formatted csv, they don't know how to read and parse the file directly. If they can't use basic filtering or a boolean mask easily with pandas, they don't know how to use lists, loops, and conditionals directly. It's great to use pandas rather than reinventing the wheel, pandas is an excellent library, but if you're going to deal with data at a very intricate level, you do need to know how and when to punt and just write the code yourself.

I think this comes up particularly in the context of pandas, because it's a common entry point into a programming language for people who don't think of themselves as programmers and may resist the notion that this is actually what they're doing.
Of course they will, it's a US company.
Ok, yes, session is a concept. Session state can be stored in its entirety or split between an ID and body.

You can send it all to the client or you can send just an ID and lookup the body on the server.

You can send it to the client via the cookie header or via the Authorization header or something else.

You can encode the data (sent via cookies or auth header) as a JWT or your own encryption scheme.

These are all different technologies working at different layers, which is why comparing JWTs vs cookies vs sessions doesn't really make sense.
Full-Stack Engineer @ Matter(https://matterapp.com)

Learn more: https://matterapp.com/careers

Matter is looking for a talented, friendly and thoughtful full-stack engineer who shares our passion for building products that truly delight users.

As one of the first 10 employees at Matter, you must feel comfortable working in a fast-paced environment.

= Bonus Points: =

* Experience with Node.js
* Experience with React
* Experience with TypeScript
* Experience in small start­up environments

Feel free to email me directly at brett [at] matterapp.com
Location: Europe (Croatia)
Remote: Yes
Willing to relocate: No (maybe later)
Technologies: Java, AEM, Scala, Javascript
Résumé/CV: Sending per request
Email: kc.kb.matija@gmail.com
District M | Multiple Positions | Montreal, Quebec, Canada | FULLTIME | ONSITE We are an ad-tech company offering solutions to publishers and advertisers world-wide in an open and transparent manner.

* Backend PHP Developer

* Front End Javascript Developer

* Full Stack Developer

* Real Time Software Engineer (Golang)

* Systems Engineer (Golang)

* DevOps Engineer (k8s, aws, gcp)

Work within a tight, autonomous team in the heart of one of the most livable neighbourhoods in North America, competitive salary, quarterly performance based bonus, 3 weeks min time off with a bonus winter break.

Internal systems we use Golang, Scala and Python.

Product side we currently leverage Symfony 3/4 and React + Redux, delivering on realistic deadlines and report to technical persons only.

On infrastructure side, a hybrid cloud with some services in AWS, Azure and GCP (k8s)

Small, rapidly growing and profitable company with opportunities for meaningful growth and impact.

Prior ad-tech experience not a requirement.

If you're in Montreal, drop me a line and we'll meet up for an informal chat about you and your goals.

Contact: mo <at> districtm.net with CV / Github etc.

Website: https://www.districtm.net
> This article is propaganda.

Someone else called it FUD, now you're calling it propaganda. I'm seeing a pattern.

> This is not the first article of it's kind; they just keep popping up over and over on HN with the same poor arguments. I usually post long explanations as to why these points are invalid but I'm tired of arguing with these people.

...they said, commenting on an Internet board where discussions (a.k.a. arguments) often unfold with these people.

Why are these arguments poor? In what sense does "JWT instead of server-side storage" make a better engineering decision?

> The real reason for these articles I think is that some developers had a very traumatic experience with poorly implemented JWT authentication system once in their life and now nothing will convince them otherwise.

Your ad hominem straw man argument notwithstanding, there are two orthogonal arguments that JWT defenders seem to conflate:

1. Don't misuse JWT in places it wasn't designed for. <- You are here
2. JWT is an error-prone cryptographic design and should be replaced with a better standard.

You can agree with one without agreeing with the other.

> Maybe JWTs don't make as. much sense for HTTP but for WebSockets they are absolitely crucial.

Would PASETO be a better fit than JWT for your envisioned WebSockets use case?

https://github.com/paragonie/paseto/tree/master/docs
What a word salad. Just because a website decides to censor unlawful and only unlawful content doesn't make it "openly far-right". Within the United States, hate speech is free speech and it's perfectly legal (except for calls for violence resulting in an immediate physical danger). Also, what the hell is a "radical centrist"? Is that what the progressives call any true liberal disagreeing with their intersectional vomit?
Microsoft | Consultants, Architects, Software Engineers, and everything else| REMOTE, INTERNS, WORLDWIDE

Microsoft is recruiting across all technical roles. Our engineering roles are primarily located in the major tech hubs (Seattle/Redmond, Bay Area, Boston, London, etc...), but we also have a large remote "field" doing application development work in consulting, highly advanced technical support, and technical sales support.

We write code and provide advice that delivers the largest, most complex and strategic implementations of Microsoft technologies for external customers. As we are a distributed organization, at least 50% travel is expected. Recruiting is being conducted broadly across all technical stacks. If you are a great developer and eager to learn new technologies or platforms, we want to talk to you.

Example projects include: developing blockchain based inventory control systems, tracking biological pathogens, reinventing an organization's recruiting platform and process, developing massive IoT telemetry ingestion platforms, and building media delivery platforms for some of the biggest sporting events in the world.

You can reach out to me directly by going to https://aka.ms/AppsHnRecruit or you can apply to Microsoft at https://careers.microsoft.com/us/en
Yeah, two months' notice does not meet my definition of "ample time to upgrade to Pro [...] or download your photos and videos.*" And it's scummy to hide the timeline in a tiny footnote. I'm sure plenty of these people are using it as a backup solution and never even visiting the site. Totally fine with the decision not to support those users anymore, but it's not reasonable to nuke their data in 3 months because some email notice got lost in their inbox.
right but some of us don’t have and don’t want chrome already installed.
Amazon has definitely got ruby code. Their somewhat new continuous deployment/infrastructure automation/configuration tools are all ruby which means every team actually ends up writing some ruby since everyone has infrastructure they need to set up. There are also some other scattering of teams that use it.
For what it's worth, we definitely don't want Flickr to be more like SmugMug. Flickr is amazing and different and that's great. We want Flickr to be Flickr and that's what we're investing in. We'd be thrilled to have you back as Pro, and I promise we'll work hard to keep you.
> Nobody uses email any more

That's not my experience.

I use email. At work they use email. My mom uses email.
What's the displacement of the Royal Enfield?

535cc vs 600cc of the CBR.

"...so , you are confirming what I said. A bike with 30hp performs similarly to a bike with 110hp."

Look bro, I don't want to argue indefinitely. They really do not perform similarly. My point is that HP is not a perfect index of performance, but being it TxRVM, it includes rough information about power snapshots (torque) and power range (RVM), and it is therefore more informative, and therefore more appropriate to describe engine performance that torque only. If you are arguing that before buying a vehicle you should take a look to its power delivery curve first, yep, that's what's more informative than torque, and hp. In absence of the curve, and being in need of indexing with a single number, hp (number) is more informative than torque (number).
Anyone hiring in Belgium? Been on the lookout for a software engineer gig, but anything that doesn't pay peanuts seems mostly shortish term government contracting :/
Do you glow in the dark?
Is it fair to assume then that this would result in:

- Smaller disk footprint per app; and

- Drastically smaller memory footprint per running process?
That's the whole point of it. Not the caveat really, but the primary feature! Whereas Electron will package chrome in every binary, this uses what you already have installed.

Obviously not great for many product types. You wouldn't want to build a product off of this, knowing that a user might not have Chrome. But for internal enterprise stuff, or community-built tooling - I can imagine this is quite useful, and downloading a 3MB binary is a whole lot better than downloading a 300MB for the same program.

I would love to see this work alongside Electron, where you can provide two download buttons for your app. One if a user has chrome already (3MB) and another if they don't (300MB).

Of course the API and model differences between the two would be hard to solve, and require another level of abstraction.
Uncountable | San Francisco (Onsite) | Full Stack / Front End, Machine Learning, Enterprise Sales

https://www.uncountable.com/careers

Uncountable accelerates the innovation of the world’s largest manufacturers. By leveraging advanced artificial intelligence techniques, Uncountable's algorithms get better material and chemical products to the market in half the time. We work with companies of all sizes, from innovative startups to Fortune 500 manufacturers.

Senior Full Stack / Frontend Engineers | $120k - $170k + Equity

---> Uncountable is looking for an experienced engineer who can spear head the development of the Uncountable Web Platform. The position is an 80/20 mix of front-end and back-end with the primary challenge being overcoming UX challenges.

Machine Learning Engineers | $150k - $220k + Equity

---> Uncountable is building a world-class machine learning team that can push the boundaries of what is currently possible with Bayesian optimization. You will have the opportunity to innovate in machine learning at a small startup.

---> This position requires experience with statistical learning theory and software development.

Enterprise Sales | $70k - $120k + Commission & Equity

---> Uncountable is looking for resourceful, scrappy, and driven professionals to grow out our sales and business development team. As a sales representative, you will be responsible for generating leads, pitching Uncountable’s AI platform to Directors/VPs, and closing enterprise deals.

These are all onsite, full-time positions in San Francisco, CA. Learn more: https://www.uncountable.com/careers

Contact: jason@uncountable.com
Pretty cool and interesting idea, and I guess the usability is banking the fact that Chrome is the most popular browser and probably installed on most user's computers.

Idea for another project: a wrapper around the system's bulit-in web-view that automatically polyfills the different engines to somewhat the same capabilities.
"Don't blame the police state for the random beatings you receive, blame the 'bad men' they're here to 'protect' you from!"
Auslogics BoostSpeed Premium 10.0.18.0 with Full Version Crack
I took at look at this and had to try installing it on my Raspberry Pi. It worked great!

I couldn't get it to recognize my microphone but I didn't fiddle with that much. It was easy to capture an audio track on my Mac while recording the screen on the Pi and bring the movie over into Quicktime and sync them up.

I've been looking for a way to record the screen on my Pi so I thank you too!
Platforms are not people. Regulating the way that companies offer their services, tax them, and how they are allowed to be structured is not a limitation of free speech.

We already do it with every other industry, social media only enjoys a lassaiz-faire regulation environment because of how new it is, the law hasn't caught up.
Hacker News is not just about "hacking". I posted it here as a reflection of the status quo about what people (don't) know about the implications of connecting home services to a centralized network.
No, you force the JWT to be verified against the DB, which might be as simple as checking if the JWT creation time is older than the password update time in the DB, and if so, force only those users to log in.

All the token does is force some extra level of scrutiny. It doesn't mean the JWT has to be invalidated,but it does give you the ability to selectively invalidate specific ones for the cost of extra DB load once for all affected users.
Yes, this was one of the initial inspirations for the design of Axiom! I never actually had the chance to play with it though... would be quite interested in learning how it works.
"If you wish to make an apple pie from scratch, you must first create the universe." --Carl Sagan
They downsample the images, which is why I don't use it. Gmail is large, but not unlimited.

Besides the gigabyte price of a harddrive is about 0.02[0], so if google makes a dollar more in advertising it can afford to store quite a bit...

[0] https://www.backblaze.com/blog/hard-drive-cost-per-gigabyte/
Working there remotely since 5 months, awesome team with an awesome product. Happy to answer any questions!
Another US propaganda material.
All of this unsubstantiated meddling talk has atrophied my care muscles.
> Enabling 2 factor

Unfortunately, they do not provide "true" 2fa, only through text message.
Did you read the linked article through the second paragraph, where they start talking about the evidence? What do you think about FireEye's statement? What do you think about their behavior - also discussed in the article - about posting on Reddit? It seems like you can safely ignore that they are Russian and characterize USAReally's behavior in the same way. When you add in their location and funding background, that just adds to the case.

edit: I added to my comment before you replied in https://news.ycombinator.com/item?id=18355858, I think it addresses your point.
I see that there are a number of different Solaris-derived OSes: Illumos, OpenIndiana, OmniOS... Given the fact that basically they all share a common ancestor (OpenSolaris) and the license (they're all CDDL iirc), wouldn't it be better to just join forces, given how niche those OSes are becoming ?
Oh, they could make it enforceable, but I don't think anyone would really like the resulting version of the internet except bureaucrats who crave power over all things.

You see some politicians mention that all software developers should be licensed, and we see companies requiring signed code to allow it to run on platforms. Licenses for servers happen in some places. Its all little step, but a few more gets you a locked and licensed computing network.
Apple censors sensitive names and phrases in gadget engraving on HK, China sites
No, I really don't have these big feels about this. I have a totally different set of big feels.

I gave up my car more than a decade ago. I eat less meat than most Americans and have for a long time. I have few possessions.

I have a serious medical condition, as does one of my sons, that is supposed to cost $100k+ annually for medical care alone (for each of us). Pursuing alternative remedies has eliminated all medical expenses and also dramatically reduced other costs, such as food expenses, because my body works better these days.

Me and my sons being healthier saves us and the world millions of dollars over our lifetimes. And if you assume the cost of that medical care in any way correlates to burden on the earth's resources, then presumably we have shrank our environmental footprint tremendously.

So I'm making as much difference as I think I can make on a personal level. I do wonder if I can make a difference more out in the world, but that seems very unlikely.

I'm an environmental studies major, though I never completed my degree. I would like to do more, career-wise, about environmental issues.

But I have a very serious credibility problem. I was a homemaker for a lot of years, so, clearly, I can't know dirt, never mind my 6 years of college and 5+ years at a corporate job. People think I'm making up the whole 'I have a dread disease and I'm getting well with diet and lifestyle' thing. Etc. ad nauseum.

I occasionally start little websites to try to put out good info that's actionable for individuals and blah blah blah. It never gets any real traction. I don't get taken seriously and can't further develop anything since I don't have engagement. I'm basically talking to myself in my little corner of the internet like a crazy person, which does not lead to anything of substance.

I made my peace a long time ago with the fact that I can only do as much as I can do. The road needs to rise up to meet me. There has to be fertile ground or it won't go anywhere, no matter how awesome the seeds of ideas are.

At this point, it's a bit hard for me to really get all upset about this in part because I was treated so horribly by so many people while I was homeless. The world didn't give a flying fuck about me and often heaped verbal abuse upon me on top of callous indifference under circumstances where that callous indifference should have helped land me in a grave.

It didn't. I'm still here.

But I kind of feel like if people really are this desperate, then they can try "the crazy thing" and maybe wonder if that woman with that incredulous story isn't just full of shit and maybe has something to contribute. And if people would rather hurtle to their doom than consider the possibility that I know something useful, whatevs.

We are all just dust in the wind anyway. And karma can be a bitch, I hear.

(shrug)
Springer Nature | Developers, UX Designers, QAs | Kings Cross, London | Full-time and Contractor, Onsite | https://sndigital.springernature.com/

At SN Digital we maintain and deliver millions of articles used by researchers, scientists and students around the globe.

We aim to offer a non-hierarchical environment where everyone can contribute meaningfully to the direction of the products and of the department. At the forefront of our beliefs are to continuously deliver high quality solutions to our customers, and to empower teams to accomplish this. All our software is built an in iterative, incremental manner, so you’ll be able to see new work go live sometimes immediately - to millions of visitors around the globe. XP and Kanban heavily influence our flavour of agile and if something isn’t working, we change it.

We are searching for:

- Kotlin developers (full-time and contract)
- Scala developers (full-time and contract)
- UX Designers
- Quality Analysts

Contact: Sarah.Sparks@springernature.com
I genuinely can't. What can a blockchain do that a database can't?
I think the problem with bundling chromium is that it wouldn't be evergreen, which means it doesn't have the latest security fixes, etc .
looks like it's basically electron but doesnt bundle chrome. and electron is a piece of crap.

edit: one time I downloaded this little mac menu bar applet that did something I wanted. I took a look at the little .js file that actually did stuff and it was about 200 lines or so. but the "application" was about 140 mega bytes. I never deleted something off my computer so fast.
Could you explain why they're important for WebSockets? Hadn't heard about them in that context before.
Well, the RDBMS solution is precisely a stateful infrastructure that (the author claims) “defeats the entire point of using stateless JWT tokens.”