skysight-inc/HackerNews huggingface dataset:
Thanks!

More information on FlexVer: https://www.raptorengineering.com/TALOS/documentation/flexve...

> FlexVer™ is a new, owner-controlled security technology designed to safeguard critical data and applications in the event of software or hardware tampering. FlexVer™ allows a system to be provisioned in a trusted physical environment, then deployed to an untrustworthy physical location while retaining system integrity.
There's a pretty detailed proposal of a privacy-preserving L2 solution for Zcash, called BOLT (https://z.cash/blog/bolt-private-payment-channels/). The original paper is at https://eprint.iacr.org/2016/701 , and there's a prototype implementation by J. Ayo Akinyele at https://github.com/ZcashFoundation/libbolt . Further development of that implementation is being funded by the Zcash Foundation (https://github.com/ZcashFoundation/GrantProposals-2018Q2/iss...). The Blossom upgrade scheduled for October 2019 is intended to include consensus changes needed for BOLT (https://forum.zcashcommunity.com/t/announcing-zcash-blossom-... and https://github.com/zcash/zcash/issues/3676).

There are also realistic longer-term possibilities for L1 scaling of Zcash, including the possibility of doing a Coda-like succinct blockchain (https://codaprotocol.com/). I've been working on optimizing recursive validation (https://github.com/zcash/zcash/issues/3425) and researching how to find more efficient pairing-friendly curves in order to make this practical. Networking optimizations and other consensus layer upgrades along the lines of SPECTRE/PHANTOM (https://medium.com/@drstone/an-overview-of-spectre-a-blockda... and https://medium.com/@drstone/an-overview-of-phantom-a-blockda...), etc. are also quite feasible.

It's correct that we're not running anywhere near capacity at the moment, and that gives us time to develop these solutions.

-- Daira Hopwood (Zcash developer)
> maintains hundreds of packages

Might be worth looking over some of these to see if he has also given access of them to some dodgy people. As most of them appear to be as old as event-stream and are also probably as unused by him. And if we are concerned, we should, he would advise, simply make a fork and write an email to npm to warn them. But hes a good guy, so don't blame him if you find that he's done this before in the other 422 packages.

Edits: I mean I do understand having software that's old and unmaintained, and it's fine and easy to hand off control to others - we developers are generally trusting of other developers. I wonder if he has also trusted others in this way before and that he has been exploited before without anyone knowing.
That will work assuming have have audited the code already, but you will also have to audit every (changed dependency)(factorial) every time you bump a dependency!
Is It Time to Move on from WordPress?
Loyalty programs fill that role.
Thanks! Most of the work these days is maintaining the 32-bit PPC JIT and keeping up with security patches from the ESRs. Unfortunately I can only shove so many new features into old wineskins. :/

But what I learned from Classilla I used to port TenFourFox, and what I learned from TenFourFox I'm using to write a POWER9 JIT for Firefox and keep the build working. So it's all incremental.
Never split the difference is fantastic. Voss gives a good amount of tangible conversation tactics that you can try out nearly same day on people. I got it as an audio book too so I can listen to it every now and then in the car.
FastMRI Open Source AI Research Tools from Facebook and NYU School of Medicine
> While serving the warrant and encouraging a witness to attend parliament "the Serjeant or his appointee may call on the full assistance of the civil authorities, including the police."

From the Wikipedia article.

So the Facebook employee was in fact under compulsion.
Or a dorm room. I could live in a dorm as long I had my own bathroom and didn't have a roommate.

It might cause me to be more minimalist and to spend more of my time outside, but I consider that a good thing.
I would caution one to not have tons of dependencies. More surface area in terms of the amount of 3rd party libraries/developers means more chances that one of them is not a responsible maintainer, as in this case. That increases the application's security risk.
I thought sports betting. It's pretty generic.
Even package managers where signing support nominally exists, the take-up is often poor.

IIRC rubygems support package signing but almost no-one uses it, so it's effectively useless.

We're seeing the same pattern again with Docker. They added support for signing (content trust) but unfortunately it's not at all designed for the use case of packages downloaded from Docker hub, so it's adoption has been poor.
instead of the lanes, you could get in/out on the ends.
Why is it a bad decision? The name is forever, a million bucks is nothing in his line of business.

The brand with a "bad" domain name needs to be kept, you have to spend on it.
If you are interested in the Android version and want to get notified when it comes out.You can subscribe to us at ProductHunt.

https://www.producthunt.com/upcoming/ulangi

It should be launched in 2 weeks.
Cool, glad to have helped. It seems I have caused a further minor point of confusion though, so a correction to the correction:

The original Nesterov Accelerated Gradient paper is about gradient descent, it's just not about stochastic gradient descent. It's useful to make the distinction between "traditional" optimization methods like Newton's method, Conjugate Gradient, BFGS and so on, which are all gradient descent methods in the sense they require at least a full gradient calculation per iteration, and a lot of the algorithms mentioned in the article, which are suitable for stochastic gradient descent and originate with the deep learning community (there's nothing to stop them being used elsewhere, it just doesn't seem that common).

Some extra (unnecessary) detail on NAG to put things into a bit more context, if you are so inclined:

Although NAG has received a fair amount of theoretical attention, as far as I know it isn't widely used practically because its convergence properties rely on an exact line search and a rather specific schedule for its momentum-like term.

The Sutskever contribution is interesting because first, it expressed the NAG formula in a way that could be easily understood by machine learning practitioners. Then, by moving the procedure a half step, they showed you could think of it as momentum followed by gradient descent.
Yes, that looks dodgy - a 64-bit 'N' being renamed 'logN', and its value changed to `1` left shifted by its prior self? I think there's a good bet that's just zeroing it out.
The actual Zuora sales deck was uploaded to SlideShare after the article was written in 2016.

Here it is
https://www.slideshare.net/ryangum/zuora-sales-deck?qid=f249...
Out of curiosity, how do these compare to `go build`? I'm jaded by years of C and C++ which of course can statically link, but doing so in practice is tedious and error prone and still often not possible (e.g., many popular libraries can't be statically linked or it's infeasible to do so).
Yes, I meant food and boarding for the trip, not for the flight. My instinct is that taking "a lot more international travel" due to cheaper airfare will result in spending a lot more money; I don't quite see why the cheaper airfare makes it make sense.
There's a difference between legal liability and moral liability.
My first thought was, "cover charge" and maybe some site that lists them and offers deals.

"Looking for ladies night near you? Triple w cover dot com for more..."

Hmmm, tough crowd. I guess 6 figure domain discussions trend that way. Definitely a reason to avoid paying for them. Check!
Some serious confirmation bias in this article.
As far as enterprise, certainly.

There are real merits to subscription models, not only in accounting but in risk avoidance (you haven't paid up front) and support (the vendor has a cash incentive to keep you happy). There are obviously drawbacks too, like lock-in and the risk of a vendor collapsing, but in some cases it looks like a good decision.

As far as consumer-facing? I'm not so sure.

Lots of companies, especially the ones with protected IP or network effects, can kick their customers around quite a bit without shifting demand.

I don't want Microsoft Office to be subscription based. I've never met anyone who does, unless what they actually wanted was the online storage subscription. (I know some people who initially said they did because they didn't want the menus to keep changing on them between editions, but then the subscription version developed the same problem.) But it's a real fight to avoid their implicit network when people keep sending me .xls files or formatting-dependent .docx or all the other things Open Office won't actually manage, so I (or rather my employers) end up paying the subscription.

Spotify, Hulu, etc are more popular, but it's still fairly telling that no one offers direct purchase of TV shows in anything short of ultra-expensive box sets. Even buying music and movies outright has become increasingly tough to do. There are probably people who will save money even with a lifetime Spotify subscription, but I suspect people who don't vary their listening a lot lose out compared to direct purchase, and people with tastes not easily provided by one streaming service have definitely lost out. It basically looks like IP holders shied away from direct sales as soon as they couldn't inflate costs by overpricing a physical medium, and left consumers without a choice.

The last category are I suppose subscriptions offering consumable products on a schedule, like Dollar Shave Club. These have more obvious value - there's no lifetime purchase possible, so it's not much different than a "reorder monthly" option. But even here they mostly seem to be succeeding by offering novelty or taking on markets that have been overpriced for ages.

I'm not sure I can think of a consumer-facing subscription product equivalent to e.g. CircleCI - something that could be sold as a lifetime purchase, which is instead sold as a subscription - for which buyers voluntarily chose a subscription model.
I don't think it's necessarily about what the buyer "needs", as much as appealing either to a big "want" or avoiding a significant loss.

Many of these companies probably don't "need" a subscription model, so Zuora focuses on the negative they're avoiding (getting left behind). From my experience, convincing someone to avoid a loss is way easier than convincing them to pull the trigger on a big win. This is a huge reason why people continue to invest with money managers instead of doing the mathematically better option of buying index funds: the money manager promises to preserve capital, whereas the index fund lists shows that it outperforms manual money management on average (big win potential).

In many cases, you're focusing less on reason and more on emotion, and you use logic to drive it home. People are more emotional than logical ("nobody ever got fired for choosing IBM"), but they need a logical argument to justify their emotions (IBM solves our problems and isn't going away, so the higher price is justifiable).
"Your whole reply is a straw man. The author is claiming that nothing explodes b/c the error is correctly handled, not b/c it was silently swallowed."

Yes, but I think that this is exactly what pilif is objecting to: the fact that there is no way for the callee to force the caller to deal with the error condition (I'm not sure that this is entirely correct, given that Go has the panic/recover keywords that are later discussed in the article, but then you might as well use exceptions).

IMO, this is very similar to what happens with use-after-free and other types of memory reference errors: they are extremely hard to debug because the symptoms/results of the error can be totally disconnected from the original source of the error, in some cases by minutes or longer. You simply don't want to have a situation where improper state is allowed to linger and further pollute/corrupt any subsequent computations.
If you can't or don't want to maintain the project and can't find anyone trustworthy to take it over, just don't do anything. This effectively deprecates the project, while not harming its existing functionality.

This maintainer actively ceded control of his library to some random person.
> Now we have to run a background check when someone wants to help? The problem is in the tools.

I don't agree with this comment, really. But -- there's almost always room for improvement w/tools. IIUC this unpacks encrypted JS bytecode and then executes it? Is there any way to statically know whether this could happen?

"var newModule = new module.constructor;"
...
newModule['_compile']()

From what terribly little I know about Javascript it looks like it would be hard to create a lint/warning that finds this sort of thing without false positives. However, an audit tool that merely discloses this and any other things-that-deserve-greater-scrutiny would be valuable. If you could walk your dependency tree and see whether/when this changes, it would be very useful. Of course, to be useful you probably need some kind of dependency pinning too, which IIUC npm does not (yet) support?
Public Market – An Architecture for Open Commerce
I love stories like this. I've heard that software brains love complexity and tend towards complex solutions when given half a chance. But after you've been burnt too many times with unmaintainable systems, the long piece of string with a couple of pulleys suddenly becomes the best solution. Even if it doesn't come with an app!
The only subscription service I use is Netflix, which doesn't have ads and is cheaper than the TV license. I wouldn't pay for anything that did have ads, and I don't see why "some people spend a lot on ad-infested channels" in inconsistent with "some people complain about being forced to pay for something they don't use".
its like watching people learn about the warranty clause of software licenses in real-time!
To me at least covered.com would have been a better choice for an insurance company. Though the cost to benefit of $800k makes me seriously question if that money could have been spent somewhere else with better returns.
How hard can it be though?

If a small child manages to wipe his/her own nose then they can be told 'well done!' but it isn't an achievement really. You would not commend a grown adult for keeping their face clean.

This GM company has been going for a century and for most of that time their products have shown no effort to be considerate of the environment. Stop-start is not rocket science. Light hybrid vehicles are not rocket science. A small child can see the absurdity of cities gridlocked by slow moving or completely stationary vehicles all of them spewing exhaust for no reason. If not the environment it is a waste of petrol. Stop-start has only came along in the last few years, this could have been marketed to people as the thing to have, who doesn't want a nice quiet car when stuck in traffic?

But GM never bothered to do stop-start, something that is a nice engineering challenge, not beyond the realms of impossible. In fairness none of their rivals took this route until the laws made CO2 and other emissions a problem for them.

We know from EV cars that going down hills does not mean lots of heavy braking, you can store the energy and save the brakes. It would not have been impossible for GM to implement something similar, even fifty years ago a solution could have been worked out with a mechanical flywheel, maybe using the already present battery as the mass for that. GM - and the others - never even bothered with that.

The aerodynamics of a car is another aspect where GM failed. It is not hard and even with no wind tunnel it can be deduced that tucking in the windscreen wipers, door handles and other parts will improve the efficiency. The underside of GM (and other) cars is a joke when it comes to aero. They just never bothered.

My background is bicycles where a 4 watt gain is pretty good. A 4 Kg weight saving is epic, the difference between a Tour de France bike and what a mere mortal can afford is 4 Kg. The chrome trim on a GM effort weighs more than my heaviest steel mountain bike. Obviously my heavy mountain bike is actually quicker than any GM product through a congested city and I certainly don't have a V8 motor in my inner core.

So where is this Bolt thing really? Are we talking rocket surgery or a kid being applauded because they have wiped their own nose?

It is easy to criticise when you haven't built a car yourself, sure the realities of mass manufacturing are hard, but I don't think GM have ever really tried. There may be many jobs and communities dependent on GM but there were many jobs and communities dependent on the predecessor companies that made buggies in the Detroit area. The sooner GM is gone the better able the rest of the automotive trade can get on with providing people with cars more in line with Ford's vision, circa Model T era, before GM came along with their planned obsolescence and before the Dodge brothers shafted Ford as best as they could.
How does this work practically when the vuln exists only in the minified version of the code?
In this situation, wouldn't it tell you the package had a version bump?
If you're on point enough to know which features/bugfixes you're getting then you're probably doing enough to be safe already. Just don't go around running npm -u for no reason and you should be fine.

The only way to be truly safe from this attack vector is to own all of your dependencies, and nobody is willing to do that so we're all assuming some amount of risk.
You can use smaller, more targeted libraries so that the changes you need to review are actually relevant to your project.
If you are being asked yes or no questions, the decision has already been reached. Politically, it is best to figure out what the decision is and then support it by whatever argument or rhetoric that seems plausible.

If the question is "can you do X?" then the important part of the conversation, defining what X is, has already taken place. You're just there to support the decision that has already been made. Sometimes your job as an employee is telling the boss what all their options are, and sometimes it is telling the boss that what they are already doing is correct.

If you are your own boss, you are necessarily one step removed from the politics. You can do your customer relationship management directly. Customers that ask "Can you do X?" without first asking "Can you help us decide what X should be for us?" can be refused, or quoted a higher price. Self-employed contracting is in some ways a wholesale rejection of politics, rather than learning how to play better. your main concern is "How do I pay my bills?" rather than "How do I avoid getting fired, and possibly get promoted?" As long as you have enough paying customers, you can more safely uphold your professional ethics.

Politics isn't about doing the right thing. It's about picking the least-wrong thing from a restricted list of bad options.
There's a difference between "errors should alter the flow of control" and "error types should be transitively declared". The latter failed in Java because the language didn't have enough support for handling the layering violation. E.g., if the X ctor throws suddenly you can't implement Supplier<X> without dirty hacks like writing an explicit handler that does nothing but rethrow an unchecked type.
From what I've read, that kind of stuff belongs at the end of the presentation. Get them on board with the vision and the problem, then justify it with figures they can use to justify buying in to your solution.

In short, appeal to emotion, support with reason.
TorchCraftAI provides a platform for building agents to learn to play Brood War
For companies, $214/mo isn't
much if it makes an admin's life easier.

At the same time, Amazon isn't going to price it so it's attractive to everybody, because it sounds like they'd rather people not use it if possible. Sounds sensible to me, legacy stuff is always going to cost you one way or another.
I didn't realise there were any smart radiator valve systems, in the UK or elsewhere, which needed to be plumbed in - do you know of any? I'm pretty sure all of them work, in your terminology, as electrically actuated 'knobs' on top of existing valves.

De/re-pressurising your central heating system and physically replacing all the valves is a task that's going to require specialist tools and probably a plumber. It's also pointless, as there's basically only one standard, so you'd have nothing to replace them with. Replacing the knobs on top is a case of watching a youtube video and spending two minutes with a screwdriver - which is the intent of the design.

What you're saying is broadly comparable to "why would you buy smart lightbulbs when you can just replace the entire light fitting and all the switches in your home?" - except I'd argue that's actually easier for the layman than messing with radiators.
This is why Erlang's crash early and restart philosophy was so eye opening when I became more and more familiar with the language and design. The whole language is about managing state and managing it well in a dynamic realtime environment (versus Rust's explicit state encoding for example).
It was in part to mirror the MDI "window in a window" concept. MDI is useful for "productivity" applications, but maybe not so much for web browsers. What's good for the goose is not always good for the gander. I think we need a new standard for "productivity" applications (office/CRUD/desktop). Bending the Web that way has made a big friggen mess.
Yes. The fact that we have so much published research that can't be replicated indicates to me that peer-review is doing less work than we think it is.
Advertisement but all because of the name! Another company sees cover.com and says "they must be serious" and purchase through them. A few times and they get their domain name money. You rarely lose money on a domain name.
> There's a difference between legal liability and moral liability

Making business decisions on the hope that someone else's moral codes will perfectly align with your own is unscalable. That's why we have written laws, codes and contracts.
There's always the "good" reason and the real reason. The "good" reason they're using to justify cell phone jammers is to stop criminal activity. The real reason they want to use cell phone jammers is money. Prisoners with cell phones don't pay the exorbitant fees to use the prison phone or send an email. I'm sure some of these cellphones are used for criminal activity but I suspect if the cost of staying in contact with family was reasonable they would see a significant decline in smuggled cell phones without needing to jam any signals.
2018 is not over, we are not even in December.