skysight-inc/HackerNews huggingface dataset:
What I think happened: Someone contacted Capital One by email to responsibly disclose to them that there were SSN's and other data on a Gist. That person found them with a simple crawler or search.

Then Cap 1 thought: If some rando can find this after a lot of damage has been done, why can't Github find these seconds after upload?

And, really, there is no technical excuse. It is perfectly possible to do this, and lots of big companies do this (or hire security companies to do this for them). Mention their name on some deep web hacking forum, a pastebin, or inside Github code, and somewhere an alarm goes off.

Github could (and should) warn if a user uploads loads of PII-like data. For the cost of running a search server and a few moderators. "Are you sure you want to upload your AWS credentials in a public repository?".

Github is somewhere halfway between moderated and a content platform. They already have a history of taking down repositories if they link to PII data (or infringe copyright, or damage U.S. national security): http://web.archive.org/web/20180619172528/https://github.com... so not acting on this specific repo with SSN numbers could be seen as a poor/shoddy job on their part. Github is certainly in the dominant position to mitigate spread of PII data, so they should have their stuff in order.
Sure. The Android people are talking about exists so Google can control everyone's life. I would not trust it to protect my privacy.
You must be really fun at parties.
This goes both ways. It’s obviously an unfortunate barrier to entry but it generally means the content on the arxiv is reputable and meets a certain bar (and submission is not in any way anonymous because members are verified which can discourage low quality submissions). Compare the arxiv to vixra. It seems unfair to Cornell university library to have them moderate submissions for scientific quality and those people who currently use it would not want to have to filter through the new papers in their topic of interest to determine which papers were worth reading and which would be a largely wrong waste of time (I think here I’m perhaps being a bit unfair and for many fields there would likely be no time wasters and in others it would be easy if annoying to filter out the p=np or Riemann hypothesis papers)

I don’t think that letting anyone submit is a good solution.
As the founder of a startup creating an AR headset, I think it’s true but the AR market is not as mature as VR.
In every tech product, first comes the hardware and then the software adds the magic at every update. In the AR world, we are still at the hardware stage. No one has the answer today for a compelling device and experience for B2C. There is no Moore law in optics and the compute power needed for SLAM, computer vision and stereo rendering is crazy if you want an untethered device (like hololens). You need more than the traditional CPU/GPU config, you need DSPs, ASICs and perhaps FPGA. Combined with the optics your NRE is high.
We are far from a market that has the same ROI as VR now, even on the entreprise the adoption is slow.
This game is hard but it will be worth it, and it’s the most exciting venture I’ve been a part of.
Top-Notch Proofreading Tools for Content Writers
I bike to work in downtown SF in one of the areas with the most scooters. Often there are more scooters in bike lanes than bicycles. I have never seen an accident, so your anecdote is not my experience.

I do often see people scooting without a helmet on streets with no protected bike lane which makes me cringe, knowing how reckless with other’s lives many car drivers are. In these situations, I think it’s better for people to ride on the sidewalk. Nobody should have to sacrifice their lives for poor urban planning, and the bruises from a pedestrian/scooter collision are much less serious than the death or brain injury from a car/scooter collision.
Why would ad-hoc scripting require more flexibility with a type system? What kind of flexibility? Is it that you need more types? Or more union types to handle all the different variations that are the same, but all slightly different?
Not without issues, at least, they would be de-indexed by Clarivate et al.
Nginx- unicorn- rails - MySQL + redis

Everything is crud so rails with percona is nice and scalable and easy to deploy.

Redis solves all the unsolvable problems... locking, queuing, caching, magic kittens, and it’s easy to operate at scale

Nginx - makes it easy to have a robust front end for serving up css / js / images with http2

Unicorn is just nice way to run rails apps
The GDPR isn't a bunch of rules, it's a process. It's no different to your health and safety process. You define your process, what data you have and where it is and any risks.

Personally, with massive PII dumps getting leaked every week I'm not surprised governments are starting to act.

> but right now, if I'm selling you something online then I still have to state in my privacy policy that I'm going to keep records of money you pay me and I'm going to store those records for long enough to comply with my obligations around tax records.

No, you don't. That's covered by the rule "Compliance with a legal obligation" because you have to do it, but only store as much as you need.
They are prone to break down as complex machines dumped in random locations out in the weather.

Scooters can last for years if kept inside and well cared for.
Well that’s good for you isn’t it! What about everyone else? Not everyone is automatically approved because of things like their email address. That’s my point - they focus on reputation and credentials rather than the blind value of the work. It’s less accessible.
Parsing Mitre EDR Evaluation Results
The Lonely Death of George Bell (2015)
You write:

They know they could bankrupt me
without breaking a sweat.

How does that work? What exactly would they do to bankrupt you?

They already started taking action but as I understand it, you are not bankrupt yet.

If you put the links back in place, what would they do next? And at which step would you be bankrupt?
Visit the Internet Archive! They do regular lunch tours on Fridays but if you call and tell them you'd like a tour they'll set something up!
> $75k... not much has changed

I don't understand this nuance. Is it standard to be paid $75k? Sounds like a lot to me.
I made my first AR demo for an expo 10 years ago with ARToolKit and IMO AR still hasn't gone beyond a gimmick. There are some popular examples like Pokemon Go but AR is not going anywhere else unless someone makes an affordable, comfortable, and capable AR headset/glasses. Holding a device in front of you gets old pretty quickly.
For a person who does not code very large programs in Python, this looks scary and like something that is hardly "only one way to do it" and that the most elegant solution gives you what you want. How I import things (or the libraries I depend on!) affects how I can write my tests? Really?

My own Python scripts are typically single-screen in length. And one-off stuff, where they either work or don't, basically.

Is this stuff really what developers of large-scale Python programs have to take into account? Or is this blog post misinformed, because there is an obviously better and standard way?
I'm confused.

First, Android is a Linux system, and underneath the app framework is really a pretty normal one. So I'm not sure what distinction you're drawing here.

Second, the grouping of related syscalls is something SELinux already does-- open, for example, doesn't care if you open() or openat(). That grouping lives in the kernel as well. So that would appear to do what you wanted?

Third, pledge does not do what you described. Although it restricts access to syscalls, the more important thing is how it restricts the behavior of those syscalls. That policy is something you could write in SELinux, but not in seccomp. And of course, pledge isn't capable of doing the useful things SELinux and seccomp can, like forbidding certain ioctls but allowing others.

Fourth, SELinux was not bitten by the VDSO issue.

Fifth, both pledge and SELinux get hit by the third party library issue in exactly the same way: you have a policy which was sufficient under the old version of the library, but something has changed and now they need something else. The only difference is that with SELinux the person who might know that the third party library had changed is also responsible for the policy, where with pledges you don't have that visibility.

Finally, I don't know what you mean with your last paragraph at all. The kernel has a contract with userspace and kernel developers broke it, is that what you mean by decoupling here? I'm not sure it was a good thing, and the kernel folks seem to agree...
Is there any proof peer review has increased scientific productivity? It is relatively new, and I don't see any reason prima facie why it would work better than an editorial teaming willing to delegate when necessary. Anecdotally, I see lots of academics complain about very important results being unable to make it through peer review. Ralph Merkel's early groundbreaking cryptography work was suppressed for years by unthinking peer review. From Merklel:

>My first paper (and, in fact, the first paper) on public key cryptography was submitted in 1974 and initially rejected by an unknown "cryptography expert" because it was "...not in the main stream of present cryptography thinking...."
This might be solved with AI. Basically you will have a personal AI that will shadow browse with you in the beginning to understand your tastes. After some time, the AI will do the browsing for you, and if needed can take adversarial routes to confuse the ad networks.

Meantime, the AI can update a private site with content that interest you.
Cloudflare again rejects ending support for 8chan after El Paso mass murder
> Sci-Hub is a copyright-violating site that provides infringing access to scholarly publications that are behind paywalls. Its ethics are problematic but it’s also proving very difficult to stop.

No. The ethics of sci-hub are not problematic. The ethics of Elsevier and their gang certainly are.
Are people using RDF a lot nowadays? I don't see it often, besides in the Java world. What use case did you want to use datalog for with RDF graphs?
You are totally right about peer review being misunderstood as replication. That's why preprints have gained so much traction lately. Things have become so complex that sometimes peer review is only good enough to filter results that are obviously wrong.

But replicating a proof or a complex experiment is way beyond what reviewers can accomplish.

Another problem with peer review, especially in experimental fields, are malicious reviewers. Big PIs typically gain control of a particular subfield by publishing something first, then getting lots of papers to review and blocking said papers and/or stealing good ideas from them.
Had the good fortune to work with Paul briefly. He's not only smart, but he's a heck of a nice guy.
Yes, and there's no loss of functionality, you can still share/Tweet/whatever. Really makes you think about what exactly all that extra JS the real button loads is doing.
I think it depends on what VR ends up looking like. If it turns out to be just 3d immersive worlds, it will probably be dominated by the big players for the foreseeable future. We will probably have building blocks that individuals can use to make something acceptable in that catagory, but the fundamantal value proposistion of that seems to me to be the visual wow factor, which is already dominated by the big players and really does require a large investment of customized art.

On the other hand, I also see a use-case of "VR" as more of a light canceling monitor, to complement current noise canceling headphones. Think about being able to sit down on an airplane and pop on your VR goggles and a pair of noise cancelling headphones to watch an old-fashion 2D movie. Or to have a full giant-display that can replace your 3 monitor desk.

These types of VR as a monitor use-cases shouldn't be more difficult then their traditional counterparts (although the tooling and ecosystem isn't as good on VR yet), so there should be room for solo developers to compete.
Have you seen this?

A compressed sensing perspective of hippocampal function

Abstract: Hippocampus is one of the most important information processing units in the brain. Input from the cortex passes through convergent axon pathways to the downstream hippocampal subregions and, after being appropriately processed, is fanned out back to the cortex. Here, we review evidence of the hypothesis that information flow and processing in the hippocampus complies with the principles of Compressed Sensing (CS). The CS theory comprises a mathematical framework that describes how and under which conditions, restricted sampling of information (data set) can lead to condensed, yet concise, forms of the initial, subsampled information entity (i.e., of the original data set). In this work, hippocampus related regions and their respective circuitry are presented as a CS-based system whose different components collaborate to realize efficient memory encoding and decoding processes. This proposition introduces a unifying mathematical framework for hippocampal function and opens new avenues for exploring coding and decoding strategies in the brain.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4126371/
What causes the much higher incidence of homelessness in males compared to females?
I believe Bill had his own company writing code - I think it might have even been started in high school.
> I don’t think that letting anyone submit is a good solution.

I think their process is totally reasonable and I’d probably do the same... but I do think it’s a fact that it’s now less accessible and more based on reputation and credentials and we should acknowledge that.
Fallout gets a new tabletop wargame–and it’s great
It does not have to be slow in all domains. In my field there are many modeling papers. Journals could require that all data and code be open access, or at least define a submission type where this is the case. You could even automate the process of running submitted containers / packages.
The moment that sharing weakness actually turns women on and attracts them sexually, is the moment that the societal discouragement of weakness in men will evaporate.
The core issue here is that companies uses AI against humans. Humans can fight back only by using AI against AI.

An client side AI is the only way to make tracking useless.
A contract the size of JEDI can (and probably is/will) build in that kind of independence as a requirement. Which isn't to say "Amazon must build and maintain an OpenStack implementation for DoD", but rather, that Amazon must turn over all APIs and source code used to build the implementation. Obviously, source code and APIs isn't enough to keep everything running - there still needs to be operational expertise within organizational memory - but the DoD would be empowered to start to take over operations and plan a migration to some other company maintaining the cloud infrastructure, if it were really untenable to renew the contract in a decade.

Put it this way: there's an old aphorism about how owing the bank $1 million is your personal problem, owning the bank $1 billion is your bank's problem, and owing the bank $1 trillion is your country's problem. There would be a parallel for cloud infrastructure: if you have a $1 million cloud bill then you have a (vendor lock-in) problem; if you have a $500 million cloud bill then your vendor has a problem (because you represent a huge chunk of business that can evaporate if you move to on-prem); if you have a $1 billion cloud bill then the wider market would have a problem (because of the reverberating shock effects if your migration to cheaper infrastructure is unsuccessful).

It's the textbook definition of something which is too big to fail.
So? Trying to break into a system can be the only way to know it's reasonably secure. This is like saying locksmiths are bad. Preventing this makes systems _less_ secure, defeating the point of trying to ensure privacy.

It doesn't even appear to be an official GitHub page (Hack with GitHub - location: Bangalore, India, email: hackwithgithub@gmail.com). Just because someone creates an "X-with-Github" repository, it doesn't GitHub are actively encouraging X.
Production from natural gas using steam methane reforming plus water gas shift reaction is how 95% of the worlds hydrogen is made. After these processes, one must anyways separate out the CO2, to make the H2 usable. This is done at industrial scale, hundreds of billions of standard cubic metres every year. Mostly the CO2 is just released, but increasingly it is caputred and stored.

The technology is easily scalable to meet demand, in fact it has to scale far less than how much battery production has to scale from current levels.

I'm convinced it's not a question of if, but a question of when this becomes a major thing. We're at the point where we need all the technological and societal mechanisms we can muster.
Sell it? Put it back into the ocean?
Clojurescript with planck is another option. https://planck-repl.org/
A curious thing that’s happened in some parts of mathematics is that formal peer review, needing coordination of journals, editors, and reviewers, can happen after many people have already read the paper (effectively informally peer reviewing it but with fewer comments), and even after people have cited the paper.

This peer review then seems to not serve much purpose.

An example is the recent first finite prime gap paper where the result was quickly strengthened several times by other authors long before the paper made it into any journal.

Another example here: https://mobile.twitter.com/adrianprw/status/1156534906618597...
Drip irrigation is heavily relied on by commercial farms in Israel
>Almost every-time one of these racists are actually spoken to the vast majority of the population reject their message.

Deplatforming is the population rejecting their message.
The problem with low-awareness is that it think's its high-awareness.
Ketchup – Big Daddy – Listen and Download
The parties you go to must be really fun to be at.
And google analytics tracking system? I guess every site on earth has that.
Peer review isn't (and never was meant to be) a golden seal declaring a result to be unchangeable truth. It is a process that makes sure that at least one competent colleague has read it and caught all the embarrassing Monday morning mistakes that might have been in there. This is done before wider publication to avoid that the 100 people in your field all stumble over the same stupid little mistake and can spent their time thinking about the actual content.

Think of it as the type checking by the compiler or a code review by somebody on your team, NOT a papal announcement of unchangeable dogma.
The problem we face isn't fuel storage and delivery, it's waste disposal. "Hydrogen economy" advocates miss that point entirely. Moving and transporting hydrogen gas is a total dead end, and I can't believe that hydrides would be much better.

I've always thought that the best approach would be to find a way to take advantage of the hydrogen delivery infrastructure that already exists in the form of gas stations on every other corner. If we could just come up with a scalable way to split hydrocarbon molecules without actually burning them, we'd be able to turn most CO2 emission sources into harmless water sources. Might as well wish for flying cars and unlimited fusion power while I'm at it, I guess...
Look at the gun death stats in other first world countries vs in the US.
Alibaba cloud? For the US Pentagon? I can't tell if serious or not.
"Hydrogen is only useful as 'short term storage' of energy."

This is exactly backwards. It is only useful for long term storage. For short term storage, other alternatives would more efficient and economically superior.

Hydrogen's advantage is that huge quantities of it can be stored underground, at very low cost. Hydrogen can act as a literal rainy day energy fund, and to smooth over seasonal differences in energy production and use.
Storing and shipping liquid oxygen is not that energy efficient. The point I'm making is that the oxygen can be used at the source of production (splitting water) to produce more fuel. Liquid oxygen storage is not something that one would do in most facilities while almost anyone could split water and utilize the oxygen to gasify their waste streams to produce syngas for heat and electricity production.
$75,000 is a bottom ~15-20% software developer salary in the US today per the BLS figures.

Someone in his ability range today will earn twice that (Gates was clearly at least a top 25% programmer in his day, more likely solidly top 10%), or more depending on location. That's before factoring in the age & experience issues, which can throw that all over the place and would be hard to adjust for today vs 45 years ago.
Also:

The Utøya massacre / bombing
https://en.m.wikipedia.org/wiki/Utøya

Jo Cox UK MP assassination:
https://www.nytimes.com/2016/06/17/world/europe/jo-cox-briti...

UK right-wing riots:
https://www.mediamatters.org/sean-hannity/right-wing-media-u...

Attacks on immigrant vendors in Greece:
https://www.reuters.com/article/us-greece-crisis-dawn/specia...

Dresden anti-islamist marches:
https://www.theguardian.com/world/2014/dec/15/dresden-police...
High-Profile Agency Recruiting for Assistant Deputy Director
French inventor successfully crossed the English Channel on a hoverboard
I mean, data science is really the thing that people should be using Python for.
Sort of. It's more a case of having all of the flexibility of a Lisp - the ability to program with wishful thinking and fill in the details later - and all of the "batteries included" of Python.

It would genuinely be worth your while to watch the SICP lectures with Gerry Sussman and Hal Abelson [1] to get an inkling of an idea of what "your program is just more data" can mean. Lisp is more about brining the language up to the level of the problem than bringing the problem down to the level of the language, and it's difficult to appreciate what that means until you've seen it. By the time you get to the end of lecture 3B, it should click.

[1] https://ocw.mit.edu/courses/electrical-engineering-and-compu...
Good. The sooner the like button and all the other 'social media' plug ins disappear the better. It's trivial to host the button and the link on your own pages. That way only the actual likes get counted.
Heh, as an American I only wish. Every day it seems like the surveillance of all kinds gets worse.
Totally agree. Airliners have a fuel fraction (fuel wt / total wt at takeoff) around 50%. Half the gross weight of the entire system is fuel. And that's with liquid, room-temp, atmospheric pressure fuel that's easy to transfer and can fit into every liquid-tight nook and cranny. Furthermore, you can pump it around for weight trim.

I don't see hydrogen in any form, including hydrides, meeting these criteria. Not to mention, the entire distribution infrastructure is tooled out for liquid hydrocarbons.

Synfuel is expensive compared to fossil fuel, but not dramatically so.

You're currently looking at ~$0.64/L for FF jet fuel, ~$0.95/L for biodiesels, and $1.15/L for fully synthetic fuels eg Fischer-Tropsch.

https://s3.wp.wsu.edu/uploads/sites/192/2018/01/Bann-Seamus-...
Good lord, don't worry about this BS, it's clearly fine outside the world of fringe complaint-seeking Internet loonies. Or well-attuned trolls, which I'd say is more likely in this case (in which case: well done troll, I mean look at this thread! But then HN's got some of the worst troll defenses around, so, middling victory).

Anywho, unless you're punning with "brought to bare" it should be "brought to bear", as in "bearing", as in the direction of something.

https://en.wiktionary.org/wiki/bring_to_bear