skysight-inc/HackerNews huggingface dataset:
alnar is likely referring to the US system, or something like it: unless you are tutored externally (rich), an autodidact outlier (gifted), or selected for honors courses, you basically take computational courses for 14 years (with one cursory stop for euclidean geometry) and are then thrown into proofs at the age of 19-20, if at all. it's widely recognized as a problem in the math pipeline, which is why many US universities have "transition" courses for non-honors students.

so it's not that the basics are intellectually difficult as much as practically difficult (unfamiliar, disorienting) for many students. many "transition" books talk about the difficulty in adjusting from talent being redefined from perfectionist "plug and chug" (APs, SATs) to reasoning and creativity.

btw, i'm impressed that you could master college-level proofs at 10. i have a kid about that age who is pretty good at logical reasoning, but i'm not sure what topic (at that level) he could do a rigorous proof about; maybe numbers, as in landau? can you say more about the materials you used?
That depends on what is meant by software architecture. If you mean the structuring of a system to achieve good or (particularly) consistent worst-case performance, maybe you are right. But if architecture is used to mean the design of a system to satisfy users (and present a clean, extensible, meaningful interface) then it's really a conceptual job that has more to do with design skills than optimized algorithms.
I agree that it would be hard to know an individuals specific contributions, but I can't see how a person can pass a good work-related interview if they're wildly under-qualified.
High end CNC controls have chuck barrier software built in that makes this less likely. It needs to be skillfully set up. High end shops may also have good 3D rendering software that can be used to prove out toolpaths. The programmer will model his machines and fixtures accurately so he can then prevent crashes. Average CNC controls at least have line output graphics that prevent non-subtle mistakes. Finally, the operator will run the first part peering into the machine, with non-cutting rapid traverse moves artificially slowed down, and with her finger poised over the feed hold button.
Doubling down on the rhetoric... Lessons from propaganda playbook.. keep repeating it .
Yes, that is the correct conclusion. There are about 0.7 trillion trillion trillion alphanumeric passwords 20 characters long (62^20). Banning 20 trillion of them is a drop in the oceans, and nobody using a password generator is statistically likely to generate them within the expected lifetime of the universe, let alone of any given website. So, if you see one of those passwords, it is overwhelmingly likely that someone took a shortcut and used your list.
>We came up with a very unique "pass phrase" and she agreed that if she got "up there" she would try to get it to me

This sort of thing is addressed in the Parable of Lazarus and the Rich Man in Luke 16. An excerpt:

"'Then I beg you, father,' he [a rich man in hell] said, 'send Lazarus [a beggar in heaven] to my father’s house, for I have five brothers. Let him warn them so they will not also end up in this place of torment.'

But Abraham replied, 'They have Moses and the prophets; let your brothers listen to them.'

'No, father Abraham,' he said, 'but if someone is sent to them from the dead, they will repent.'

Then Abraham said to him, 'If they do not listen to Moses and the prophets, they will not be persuaded even if someone rises from the dead.'" (Luke 16:27-31)
This is such a cop out. It took millennia to invent 0. That doesn't mean that 0 is an exceedingly difficult concept to grasp.
kind of cool but why is the model trained on such a small data set? why not train it on a bunch of codebases that use type hints?
Sure, you can come up with an algorithm question hard and obscure enough that no one will be able to answer it in the time given and no one will have bothered to memorize it because it's so obscure.

That doesn't mean all "implement X algorithm questions" are categorically bad.
Do you believe it's likely the driver is at fault given the lack of evidence?

When I imagine a pet getting killed by a car I image it becomes free and running out in front of a car, not a car breaking a law and encroaching on the pets leash space. Perhaps there are some counter-intuitive stats on this I'm not aware of :)

Further, there are a LOT of places where a person on a sidewalk would be within a leash length of a car legally driving 30+ mph.
\tangent In the spirit of understanding the mind in terms of the engineering of the day, the cerebellum's striated structure seems something of a DSP, for linear processing, especially where timing is involved.

There's a dramatic contrast between the sophistication of optogenetics, and the primitive hypotheses being tested: is this connected to that?

Does there need to be a direct connection, or could other parts of the brain use the cerebellum, when limear/timing is needed, for particular stages of processing, like a math co-processor?

e.g. Is it possible that instead of direct "wired" connections, there's a packet radio or UDP-like system, where neurons (or columns of neurons) aren't directly signalling, but passing on a packet of information to be shunted elsewhere in the brain.
Apple Shares New Videos Highlighting What You Can Do with an iPad Pro
Potentially two things here:

1) Gathering requirements.

2) Turning those requirements into data structures.

I think a lot of companies will separate those into different roles, but I strongly believe that's a costly mistake in most situations. There's a feedback loop. Requirements inform your data structures, but your data structures help you contextualize (not pollute) your requirements. If you're working with an existing system, you also want to understand current structures in order to guide requirements. By guide, I don't mean to ignore pain, but if you're building a system to support multiple clients / users, then the real trick is to figure out how to do that in a cost-effective and elegant way.

When these roles are separated, and the requirements are gathered without knowledge of the structures, I believe you're setting yourself for failure in the long term (spaghetti code / everyone gets something different).

Getting these to gel is the puzzle I'm personally passionate about. I don't mind what I would call the math side of programming / code puzzles, but it simply doesn't give me the endorphin rush that building a system that elegantly ties things together does. The best is when you're working towards that or have achieved that and inspiration for further possibilities, improvements, efficiencies start popping up.

I'm not sure how you test for this as part of the hiring process, at least not efficiently. I do think we get better at this with experience, but I doubt it's exclusive to seasoned developers.
For anyone curious, David Paulides has been shilling his book on the internet in the grossest imaginable ways for at least a few years now. There are threads banned on 4chan's /x/ board because they're part of this spam. 4chan.

If the guy sincerely felt these alleged "conspiracies" were so significant, he wouldn't do everything in his power to restrict access to the information and then sell it like an infomercial.
This seems like an important part that's buried

> Compared to monolithic Linux, there is a small performance tradeoff because of the µ-kernel architecture. However, the initial L4Linux has been somewhat optimized, and on L4/x86 it has a very acceptable slowdown of less than 4 % for any relevant load.

If it provided any additional security guarantees in trade for that 4%, I imagine it'll become a popular way of running Linux
Note that you will want to own at least two and enroll both of them to properly lock down a service so that it doesn't need some plan B. The reason is that obviously if it's locked down to a single U2F Security Key and that key breaks or is lost you're screwed.

Google's programme aimed at high risk people (e.g. journalists covering government corruption) specifically aims to leave you in a position where so long as you have control over the physical devices your secrets are safe, and if the devices are destroyed then your account is irrevocably lost and too bad. Doing that with just one key is asking for trouble.

If you're just dipping your toe in the water, buying one key and having your plan B be a bunch of one time codes written in the back of a diary in your locked desk drawer makes sense, and if you're mostly just interested in the cool technology and not worried about security then going to a Key with Google Authenticator as plan B is fine too.

But if you want this to solve all your problems as advertised, buy two keys.
If the password actually has a lot of entropy but it appears in a breach then that's some fairly strong evidence that the user is reusing it.

Specifically if it appears n times in the HIBP database you should assign at least roughly 1/n probability that the user is reusing it.

So if you assign disutility -V to letting a user have a known username + password combo and utility U to letting a user sign up with a known password but unknown username, the utility is (n-1)/n×U - 1/n×V

Reasonable values of U and V for a given site will be different depending on the application, but for online banking -V would be maybe -20 and U might be negative as well. You wanna bank with a public password lol? For something like gmail or Facebook it would be the same story.

On the other hand if the password is quite weak then it's vulnerable to credential stuffing. If it appears, say, 10,000 times in the HIBP database then most likely it's as good as public whether or not the user account name is known.

Maybe there's a sweet spot around 50 instances where you can't really credential stuff it, and you also aren't that sure that it's a reuse.

In terms of usability you could tell the user to change it up a bit, add some words.

For example, r0bbiewilliams appears 5 times in the database. luvrobbiewilliams appears 0 times AND IS PROBABLY EASIER TO REMEMBER!

You can almost always get away from a breached password by adding a small amount of text.
Anyone else remember netcom.com?

I was an early Netcom user. In fact, I had what they called a PNC (Personal Network Connection) account, which offered full TCP/IP connectivity and shell access.

When that was killed, I moved to accesscom.com to keep full access, including shell... until that went away as well.
I interview programmers. I would love to see a candidate who prepared like this, but it seems like everyone I talk to hasn’t done any practice at all.
> That something is addictive doesn't absolve you of accountability; you still got addicted to it

A fantastic lesson in how to not understand addiction in the slightest.

I look forward to a more mature response when you get past whatever juvenile phase your comment is the product of.
> If the password actually has a lot of entropy but it appears in a breach then that's some fairly strong evidence that the user is reusing it.

I'm not talking about scenarios where you can associate the password with a specific user.
When your definition of memorization encompasses all forms of learning, saying memorization is crucial to learning is pretty much a tautology. No one claimed that amnesia sufferers are perfectly good for mathematics. Same goes for repetition. No one expects you to understand and never forget the theory of cohomology by writing down a long exact sequence once.

The thing is, the root comment of this thread specifically talks about "continually review what you've learned and NEVER forget anything" through looking at highlighted notes in the software mentioned (a somewhat out-of-place plug, I'd say). That's not how math works. You refresh your memory by tackling preferably new problems. Reciting proofs is largely pointless (except for certain very elegant proofs, in which case you probably won't need to recite them anyway); reciting definitions and theorems is even less useful.

> it's meant to 'freeze' all of your knowledge so that you never forget it - ever.

Yeah, no, you don't "freeze" your mathematical knowledge.
My dad used to tell me this story of how when he was in his 20s he had a can of drink and he was looking away at something and as he looked back at the can to take another sip he just saw a bee crawling inside the can.

Never say never.
We used per-packet tx timestamps and timer based reordering detection in Teclo's TCP stack[0] in 2011 and later. The important bits with a time-based reordering detection heuristic are to a) make it dynamically adjust to observed network conditions, b) make it take into account some of the factors that affect reordering probability. E.g. reordering is much more likely for packets of different size than of the same size.

BTW, the assumption you quoted that there won't be more than 10ms of reordering is false. Reordering of up to 50ms was common in mobile networks.

[0] https://www.snellman.net/blog/archive/2015-08-25-tcp-optimiz...
The number of different SKUs is totally absurd.

As of right now my local supermarket (subsidiary of Kroger) has the following:

Cheerios 12 oz
Cheerios 18 oz family size
Cheerios 20 oz giant size

I'm not talking about "honey nut", or "multi grain", or "cinnamon oat crunch", those three are just the basic Cheerios.

It's way beyond stupid. This idiocy is the fault of both the manufacturers and retailers.
He's so rich, he has a yacht in the swimming pool of his super-yacht.
they can't offer health results at all in most of europe and other countries. I don't think that's fair either, why is my government trying to protect me from learning anything about my genotype? Especially considering european countries that have socialized healthcare (and thus healthcare costs cannot be affected by letting this info out). This legislation does not make sense.

https://int.customercare.23andme.com/hc/en-us/articles/21769...
The odds of a user randomly selecting that password, rounded to 20 decimal places, is 0.
The user settings could have CSS by kind of element (such as <article> or <body>), or by CSS classes, or other attributes (such as ARIA), although stuff such as <article> isn't consistently applied anyways. If necessary, there should be some way to specify global CSS rules which are not applied to webpages that have their own CSS (either in the document or defined by the user).
A Book Lover’s Haven Turns 100
more props for this guy!
This. Who beat every single private organization with Spectre/Meltdown mitigation? Amazon Web Services.

There is a pervasive myth that servers run by private organizations are more secure than those run by the public cloud providers, and the opposite is actually true. Does your organization receive embargoed information from Intel to mitigate side-channel 0-days before they are publicly announced?
It’s the best way to get into it anyway. Making architectural decisions without experience implementing them sounds like a recipe for disaster to me.
> If you verify that your hardware is unstable, how can you expect the software not to fail and corrupt data?

No such thing as 'stable hardware' at scale.
> This just reads like "Hey, stop aggravating for a better life, at least it's not as shitty as Brazil."

Sorry - my intention in linking that chart was to compare the US against other wealthy, Western nations: ~15x more per-capita police killings than France and Germany, and 60x more than Poland or the UK.
No, it's not the correct conclusion. Virtually no passwords are safe under an offline brute force attempt if they haven't been protected by a robust key derivation function and a randomized salt. If the password has been protected like that, you not only need to try all 20 trillion of those hypothetical passwords; you also need to try them with the correct salt.

And this is aside from the fact that you won't even rip through those 20 trillion in an online brute force attempt. Eventually you are only constrained by computational resources. If the passwords are cryptographically secured, it's fine if any one of them is published on the internet if you cannot associate it with any given user. If they're not cryptographically secured, this won't meaningfully reduce your already poor security anyway.
So you're saying that it was your choice to have your first bite of sugar, and you could have abstained?

This kind of "abstinence-only personal fitness" might work fine for cigarettes, but kinda breaks down when it's stuff you've been fed since you were 5 weeks old and has been injected into most pre-prepared foods in a "sweetness war" that's lasted decades.
Generals often start out as lieutenants though (e.g. officer academy drops you in on a higher rank).
One good thing about this is that it encourages me to write charitably if I would otherwise speak of someone critically. I write and do anything as if it might end up in court as evidence basically. Could be tiresome but I’d like to think that it motivates me to be more positive or careful.
I wonder if there may be two issues here, one related to consistency and one related to twins. That is, you may not need twins to get differing results, but being twins may still be one of the reasons for differing results.

I'm not a biologist, but apparently it's not the case that twins have exactly identical DNA:

"Identical Twins' Genes Are Not Identical" ( https://www.scientificamerican.com/article/identical-twins-g... )
> "Sure, Sugar can be acceptable if you use it responsibly. You can even safely consume a Soda if you're in a glycogen depleted state such as after a marathon or from 16 hours of fasting."

Of __all__ the soda consumed what percentage would you image falls into this loop hole?

The reality is, sugar (and carbs) for many people are not consumed responsibly. And give the degree of irresponsibility, 99.9% of these people aren't running a marathon or fasting for 16 hours.
The idea seems to be to use paravirtualized Linux as a “time-sharing component” of a system that otherwise provides real-time capabilities...
Meta Nothing? The Theory of Emanism
But what is the harm in blocking all 20 trillion such passwords? Do you expect to have any false positives?
It’s hard but we did it a week or two back for our current travels in China. Wechatpay is accepted everywhere- either by you sending money to the buyer (smaller retailers, requires your phone to be online) or by the retailer scanning you (larger retailers, you can be offline).
E.g. At a large high quality restaurant we were at yesterday we could not pay them at the table so we went to the checkout and the scanned.
Credit cards are not useful except for pulling cash out of ATMs or at really western stores. Cash is only as a backstop, or perhaps to ask someone to send you wechatpay balance.
I found it easier to sign up to wechat(pay) than TransferWise, who have 3 potential authentication methods and none work as advertised in my country.
WeChatPay works because of the higher level of trust the app enforces. The retail economy is being run on these systems and that trust is critical. Facebook, Twitter and google have arguably thrown away any chance they had of doing universal payments through their poor ability to ensure trust - far from it.
Ahh, okay. I read the "things look less peachy" to mean it's worse elsewhere. Sorry about that.
> This sort of thing is addressed in the Parable of Lazarus and the Rich Man in Luke 16

IMO that passage only addresses it in so far as to make up an excuse to explain the silence. If even a modest amount of the supernatural claims in the Christian Bible are true then at least one of them should be reliably repeatable. And despite years wasted looking I'm not convinced.
Downvote away but it's true; she says as much herself: https://twitter.com/SarahTaber_bww/status/105707517878883123...

If you just read her Twitter feed[1] you'll get plenty of great hits, like dismissing the farmer who farmed for 40 years and went bust I linked to elsewhere because he was a) white (!) b) was planning on "cash[ing] out" earlier (she somehow knows this after discussing the issue with "colleagues," nevermind the huge pattern backing up this story's vignette).

Her answer to the dairy crisis is just "grow something else,"[2] which I can tell you with firsthand knowledge is beyond flippant. You don't think farmers that are committing suicide at record levels perhaps considered this?

Scroll back and you'll see plenty of hyperbolic drivel.

[1]: https://twitter.com/search?f=tweets&vertical=default&q=from%...

[2]: https://twitter.com/SarahTaber_bww/status/104693232563910246...
> Just in case, decades ago my dad put the land in a family partnership of which me and my siblings each own 19%.

Is it that easy to bypass the estate tax? I'm surprised it collects basically any money at all, if all you have to do is make your children "co-owners" before you die.
Nicotine is more toxic than tar and other substances, as measured by the LD50; it's just that those substances are all really hot and carcinogenic.

360 mg / 6 = 18, less than 1 pack has a lethal dose of nicotine. However, since uptake by the body is low for nicotine, smoking what would seem to be a lethal amount doesn't kill people.

https://www.webmd.com/smoking-cessation/nicotine-poisoning-c...
FWIW: http://www.catb.org/~esr/writings/taoup
This is a neat solution! My coworker documented how we mimic the PwnedPasswords API serving (lots of) static files: https://blog.benhaney.com/2018/11/04/recreating-pwnedpasswor...
Many people use the known passwords list with offline cracking tools.
BFS as a name isn’t a difficult concept to grasp either.
First of all, in an online brute forcing scenario attackers will never get through the entire 20 trillion. Even if they knew for certain that the target victim's password satisfied the precise constraints of the passwords published in that list, they'd need around 2 years (with reasonable assumptions of millisecond latency) of constant, 24/7 attempts to run through them all. This is assuming there is no rate limiting.

In an offline brute forcing scenario, either the passwords have been hashed with a strong key derivation function and a randomized salt or they haven't. If they have, it doesn't matter if the password is in that list. If they haven't, you're most likely screwed either way, because attackers can get up to 1 trillion password attempts per second in real world cracking setups now.
> If any of this acceleration is associated to the corresponding increase in vaping over this time, then the vaping industry is possibly the leader in saving lives.

That doesn't appear to be the case.

See the chart in https://www.motherjones.com/kevin-drum/2018/12/the-juul-fad-...
Just moved to Montreal from the US. Was astounded that chicken price per pound is 5x the price it is back home.
well when the password got breached it is associated with a particular user.

And HIBP will tell you how many times a given password appears, but not which account it appears with. See:

https://haveibeenpwned.com/Passwords
Yeah lately HN is high on sugar and obsessed with China.

Maybe the next article will be some conspiracy theory combination of the two.
Nope. I deal with enough social crap as is. This would be another element of social crap making my life harder.
You can in fact associate the password with a specific user - the fact that that exact password is being reused is, by itself, strong mathematical evidence that it's the same user or someone they told the password to, because it is basically mathematically impossible that anyone else could generate the same password by coincidence (unless they're both using a password generator that doesn't have good random seeds or is otherwise deterministic, in which case you should be banning the password anyway).
The harm is the principle of it. You should not design a system that greps through e.g. every single breach dump for arbitrary passwords every single time someone tries to sign up for your service. That's maddeningly inefficient.