skysight-inc/HackerNews huggingface dataset:
I disagree. Systems of management are important. There are going to be some people who work well under a strongly hierarchical system, some people who work well under a flat system, and people who could hack it under either. Thing is, there is no reason to believe that the people you attract under any given culture/structure is completely independent of ability to provide a product or service.

For example, GE is a very hierarchical megacorporation, BUT it has found it expedient to make its aircraft parts manufacturing flat, because parts don't need to be turned out so quickly and individual workers can have multiple specializations.
I'm totally with you on this and I'm trying to fix that issue with an open source curriculum for aspiring developers at https://github.com/theodinproject/curriculum that charts a path through existing content and encourages collaboration on projects. It's still quite preliminary but some students are already finding value with it. Hopefully it's the kind of thing you wish you'd had when you got started!
Good. Can we finally have contactless smart card access control in the mainstream now?

The audit and management features of an electronic access control system already make mechanical keys inexcusable on any door that >1 person needs to open. Hopefully revelations like this will push more organizations to upgrade.
Do you really think he set up Amazon in order to exploit a tax loophole and not because he is a visionary who wanted to change the world?
Hm, I see your point.

How would you then recommend installing non open source software on a production system? E.g. a freeware (but proprietary) FTP server or a database engine.
Co-founder here. Legal bills are not considered "work product" so the client can share them if they choose.

The content of legal bills is very important to protect. We have technical safeguards as well as management/process safeguards. The most important of which is limiting the number of people with access to actual content.

We have data and can price compare across geographies and law firms. But it is important to remember that each transaction is unique. That's why we don't release any of that information currently. If we find the right way and the right venue to share that aggregated information, we will do so if we think it is in the best interest of our customers.
Human behavior toward keys makes mechanical locks insecure. We've been able to reproduce keys, even fairly complex ones, well before 3D printers came along. Get a clean enough impression/scan/photograph and we can make it happen, perhaps 3D printing is seen as making it more accessible to the general population.

I'm about to go on a whole thing here, so let me first say that I am excited about their work and I have personally been pushing for years to see more high security key printing happening (see Nirav Patel's Abus Plus key printing[0])

What I take umbrage with is the idea that this development is going to be the death of mechanical locks. Even the suggestion that it _should_ be the death of mechanical locks. In the Forbes article [1] One of the students behind this work suggested that his goal was the elimination of mechanical locks:

"If we show that mechanical locks are vulnerable to key duplication just by having a handful of numbers you can download off the internet, hopefully they'll be phased out more quickly," says Van Albert.

What this fails to address is that the cuts on your key are supposed to be a secret, and your behavior toward your keys should be the same as your behavior toward a password. You don't pass it around and you are very careful about who you trust it with.

I also dislike the characterization of the discovery of the "numbers" in the main and sidebar bittings. That information has been publicly available and the suggestion that they "reverse-engineered" (from their abstract submitted to defcon)[2] the lock is a bit dramatic. Better, I think, to say that they "read the documentation."

Obviously I have a chip on my shoulder when it comes to mechanical security, but I am confident saying that any call for the blanket abolition of mechanical locks is short-sighted and narrow-minded. This could have been an amazing opportunity to address human behavior as it relates to mechanical security, but instead it was wasted on the age-old call for the death of locks. There remain myriad places where a traditional lock is still required, there are myriad populations who are not able to sustain electronic locks.

If the day does come when mechanical locks can be left to the dust of history, it will be more likely the result of dramatic shifts in society than in technology. It will be the death of all locks, not just mechanical ones.

[0] https://github.com/nrpatel/PhysicalKeygen/blob/master/abus_p...
[1] http://www.forbes.com/sites/andygreenberg/2013/08/03/mit-stu...
[2] https://www.defcon.org/html/defcon-21/dc-21-speakers.html#La...
To be fair, these jokes do clearly follow the 4 points laid out in the article.

In addition, I did snicker at #2.
It's not "curl | install.sh" vs "configure/make", you know? What about using any package management system?
Is 12% massive? This seems an exaggeration.

It might be worth mentioning that for the last year or so GM has had $4K incentives on the car anyway. So really, they're just cutting the price by $1K.
The Defense Never Rests – wireLawyer is Disrupting How Lawyers Work
Yes, exactly. Using a separate router it's possible to transparently force all traffic through the Tor network.
Well firstly, I believe we're the first distributed Docker-based PaaS to be released. We are using Buildstep for Heroku Buildpack integration, which is part of Dokku. And we've been talking with the Flynn crew about how we can create more reusable components for the Docker PaaS community.

Our use of Chef is reflective of a larger design decision to work with DevOps tools that are already in widespread use.
>It's horrifying until you realize that all the same things you fear actually happen today, except that the entity doing those things is a monopoly which is less accountable and more hostile to the public than any corporation ever could be.

That's only the way one sees it if you have a market bias.

For what it actually is, is an organization setup by the people (in most countries people literally died and fought to be able to set up their own government and state) and controlled by the people through voting off and on and through participating in it.

It's not perfect but far better than the alternatives were private interests play it out. And we had those, historically, only instead of corporations the private interests at the time feudal lords and large land-owners.

The effectiveness of government, and the purer representation of the people, only depends on one thing: the people's vigilance and participation in politics. People withdrawn into their own private affairs do not deserve neither freedom nor a state, and they don't get one, either. They get "career politics" to fuck them over. But that's not a flaw of democracy: it's a flaw of the people not taking care of it.
Yep - you nailed it. I don't ever want to be a "me too" company - or a "me too" person for that matter. But it's so easy to go half way down that path before you've even realized it.
Has anyone looked at mitigating the attack by changing the behavior of chunked transfer encoding?

Chunked Transfer encoding is basically padding that a server can easily control, without having to change content or behavior of a backend application. A web server could easily insert an order of magnitude more chunks, and randomly place them in the response stream.
Just guessing that the source may not be completely unbiased!
I don't understand (and am interested). What's "static" about it? With Apache and mod_rewrite and CGI, I could make the functionality you want (which is, of course, completely not low footprint, but I don't understand how what you want is different from CGI).
There is a simple fix for this and FireFox uses it. Simply, allow users to create a master password to view stored passwords. They don't need to be asked to enter it every time they log into sites so the ease of use remains. But, if a stranger gets a hold of their machine, they will be one giant step farther from retrieving their passcodes.

PS. This was always an issue with Chrome, and it is why I don't use Chrome on my mobile machine. Safari has a similar problem. So I recommend 1Password for mobile computing if those are your browsers of choice.
Great team and company in an industry that is ripe for disruption. Hopefully they can streamline the inefficiencies in the legal realm to offer better rates for clients.
Your assertion is that if we want to vet the code, there are steps to do that and no conventional installation includes these steps, correct?

Well, getting the "trust us, this is easy" type installation instructions here isn't terribly comforting from a brand new project. That's the sort of thing I'd expect from a source I know. Not from this project that I didn't even know existed before this post.

It's unrealistic to expect those who take security seriously to do so in the first place. Regardless of how often it's done elsewhere.

OTOH, there's a well known and trusted software distributor that does the vetting for you, which this project doesn't have, and I'd much rather do the "vetting-skipped install" if you will for something they distribute instead.
Not in recent versions (the idea being that users w/ JavaScript disabled "stand out" more from typical users).
Most large companies (banks, insurance companies, large retailers) do have strict billing guidelines as to what firms can charge for.

We (SimpleLegal) will work with those guidelines and train our models accordingly.

Example: Walmart's Outside Counsel billing guidelines http://www.acc.com/advocacy/valuechallenge/toolkit/loader.cf...
You can make a electronic bump key that will open most doors for <$100, most buildings have windows (cover them in duct tape to break without noise), and even the wire mesh in the walls of a "secure" building can be cut with thermite. If you want real physical security you're going to need much harder materials: steel, titanium, tungsten, concrete.

This comment captures the security problem well.

> "[Locks] are more of a tamper-evident seal, or a delay tactic. The issue with bumping, picking, carding, and 3d-printing is how it invalidates the current approaches towards those two aspects."

However, of those options, 3D-printing is clearly the worst. Bump keys and carding latches takes seconds, picks minutes, and 3D printers hours. It seems that the only situation this method would be useful is with advance access to a key, a radial-pin lock, and a free 3D printer.
All of his comments seem to be very along the line of: "Fuck you, why are you talking to me about this thing I posted online?"
Not the same meaning, but potentially also applicable, is Walt Whitman's quote:

"Do I contradict myself? Very well, then I contradict myself, I am large, I contain multitudes."
but you do have to break a few eggs to throw the baby out before it's hatched.

"If we hit that bullseye, the rest of the dominoes will fall like a house of cards. Checkmate!"

- Zapp Brannigan
Pretty amazing hack to get around the size limitations of NAND flash feature size.
True. Though for a bit of benefit, if the download was hosted separately from the site, that'd be two things to hack. The downside, of course, is that script updates would require new SHA1s. It would be best, then, to insert version numbers into the installer scripts, and a version check. That way if a new version comes out, the installer could warn about it (y/n), while still verifying the SHA1.
You take a large chunk of someone's money, and along with it comes responsibility and accountability.

Insightful.
As for the privacy concerns, we use data to train our machine learning models. The outcome of those models includes categorization by activity (internal meetings, phone calls, legal filings, etc.).

The "shared" component is for training purposes. At no point do we share invoice content. The key to convert a numeric vector back into a partial view of the original text changes every day. Security and confidentiality of customer data is a big area of concern for us. We also provide our customers with a named list of people with access to the content.
Show HN: Spacedeck Sandbox
One gem, in case somebody missed it:

Model Number: H2G2-42.

- Wasn't "42" the answer to life, the universe, and everything in The Hitchhiker's Guide to the Galaxy?

- And H2G2 is an abbreviation given to the book, as well as the name of a website dedicated to making a guide to life, the universe, and everything.

We see what you did there, Google. Your clever nerd humor will not be lost on us!
How Obama for America uses Google Analytics
That's actually one command/operator (c) with different motions (in case, they're all text objects).
I understand that a master password would just lead the user into a false sense of security. However, I feel that it should be make as hard as possible to find the user's password.

A good safe is judged by the time required to break it. There is no safe that is unbreakable, you just need to put enough time, effort and noise to open it. Same thing could be applied here. Installing software, dump the cookies and so on requires time. Right now with this security a person could get my password in a couple of clicks with almost no technical knowledge. I'm not talking about a clever hacker, but rather a random person in a cafe with wifi asking someone if she could check her emails and steal the password while staying in Chrome. Again, it's not about making it impossible to retrieve, it's about making it a bit harder than just clicking the "show me the password" button.

Of course I would never give physical access to my machine to anyone I don't trust. I always lock my computer when leaving it unattended... but I really doubt that anyone acts like that. It's a pretty geeky thing to do and the mainstream crowd isn't as worried by security.

Let's say the master password solution isn't good because of the feeling of security it brings. Instead why not never show the password? Just say to the users it's stored on your system, but don't show it in plain text in Chrome.

My point here is that there is little to no value (unless I'm missing something) to display the password in plain text, but there are some drawbacks (easy to see for semi-technical people). So why have this feature in the first place?
The crypto library should be given the unparsed payload and either complain the signature is invalid or give you the parsed payload.

There is no price to pay in apps, since there are such crypto libraries for most languages.
Samsung 3D Vertical NAND crams a Terabit on a single chip
Get the Snap n Go - there's a 50% chance you can transfer the child to it without waking them up. This is worth it.

Also, buy a portable crib that you can stick in your luggage. It lets you go on a quick trips as a family without lugging a huge crib arroud: Phil and Ted make a good one - they call it a travel cot.
John Kiriakou: Obama's abuse of the Espionage Act is modern-day McCarthyism
Intrusion with a 3D-printed key is deniable, while breaking a lock isn't. Someone could enter your house with a printed key and you'd never know it; a destroyed lock would immediately tell you someone broke (or tried to break) into your house.
Emmet LiveStyle — live bi-directional CSS edit of new generation
Imprecisely? It is a matter of perspective.
This is a pretty interesting part. I was pretty convinced that the FLASH guys had nowhere to go with respect to geometry limitations, clearly I was wrong. :-)
How to Sell a Startup Client on Value
Cybernado.
Boston is the new hot hunting ground for Natural Language expertise
That's completely orthogonal to what we're talking about here. If you're already not doing it, you're not doing it any less by being more efficient. And it doesn't really matter if you're running it in a throwaway VM like I do.
Check out my startup!  (advice)
http://www.the-collage.com/

Open for criticism - will appreciate everything!

I started this site a few months ago all by myself and Im well aware of my tech skill level so i understand Ill be getting some of those comments "the call to action buttons look like screenshots of CSS buttons?" haha

But I would love to here your POV all around. Thank you so much for your time - it is greatly appreciated.
Truly Ig Nobel Prize worthy.
The case of the Sharkanado - Nielsen: Twitter and TV help each other
It takes "30 seconds" they claim, but is that at a rate 100 requests per second?

I took the 30 seconds to be the amount of compute time required after they had their samples. Otherwise it is a meaningless number, they could say it takes 0.5 seconds at a rate of 6k requests a second, or 3 thousand years at the rate of 1 request per year.
You know your way around a legal bill!

As bradleyjg points out, some charges make their way onto a bill when they shouldn't. It's usually not malicious.

The problem is that legal bills don't get enough attention from the law firm. They rely on the client to tell them when something is a problem. We make that process easier. And hopefully everybody, even the law firm, is happier.
Ask HN: Why do brands spend CPC dollars for own brand name?
I have always wondered why brands spend money for their own keyword name on Adwords. For example, why does Amazon waste money for the search term 'amazon' if they will always be the #1 result in SERPS?
Their joke model misses one thing: each noun has to be commonly used in the phrase "I like my <noun> <adj>". People often say "I like my coffee black" but nobody ever says "I like my source open." I think that is why they sound weird. But I like the off-kilter unexptectedness.
I'm sure many developers and companies were affected the same way, which sucks for everyone. Apple isn't the first or the last company to be compromised and subsequently tight lipped, I just hope they do something nice for their customers/users the way Sony did when PSN was brought down.
Amber Alert: Californians confused, angry and startled
Speaking on behalf of the Docker project, I am very glad that the two first PaaS projects built on Docker happen to be led by Jeff, Daniel and Jonathan (for Flynn) and Gabriel's crew (for Deis). They are all active and helpful Docker contributor who "get" the importance of interoperability between Docker projects. They have pledged to play nice with each other by focusing on reusable components which will benefit the entire Docker community.

So for that, thank you! I hope more people follow your example and remember open-source is not a zero-sum game.
Self-Balancing Unicycle
>And I think it's highly naive, this distinction between private companies as greedy, interested parties and government agencies and functionaries as objective arbiters of truth and goodwill.

Higly naive?

A government agency can be greedy or good.

A private company is by definition greedy. It exists to make money.

Unlike the second, which does what the owner/director likes, a government can be controlled by a vigilant voting population, that eagerly participates in political debates and raises issues.
And another thing! The French Patent office many years ago ceased allowing patents on keys that did not have a movable element, which led to the development of many keys that cannot be readily duplicated without access to either the restricted blanks or very serious equipment & knowhow with which to make the blanks. These systems remain well outside the realm of 3D printing. DOM Saturn[0], Mul-T-Lock Interactive (and up), Vachette Radial[2] and a handful of others.[3]

Mechanical locks are far from dead, but I'd love if someone reading this took it as a challenge to reproduce keys with movable components. I'm a big proponent of pushing these systems and finding ways to circumvent them, using any technology available. I just don't like it when the response is to throw the baby out with the bathwater.

[0] http://www.dom-sicherheitstechnik.com/DOM-ix-Saturn.667.0.ht...
[1] http://www.mul-t-lockusa.com/614.html
[2] http://www.vachette.fr/fr/site/Vachette/Systemes-de-Securite...
[3]http://www.lockpicking101.com/viewtopic.php?f=9&t=56691

(edited to add links)
In that inexperienced users are not well-informed of the option to disallow it, and might not understand that indiscriminate, promiscuous execution of JavaScript as a default behavior can be hazardous. ...at least as hazardous as connecting to unencrypted Wi-Fi.

To whit: http://beefproject.com/

New users aren't even readily informed that JavaScript is a thing.
This is substantial when you consider that a few years ago GM has been losing money on each car they sold. I believe it was something like $200 per car...
Funnybot online...AWKWARD!!

On a more serious note, it's a nice, albeit kind of low on benefit/cost, application for Big Data.
Fair enough. I think my bias showed. :-)

So a question in return... Do you share my belief that documentation tends to lag in most projects? And if so, is the bottleneck not enough documentation writers, or not enough engineering time and attention? I've assumed it's the latter, though it could be the former. Or is it something else?
In a model year, sure. However this may be the last year before the refresh. With the Cadillac ELR coming out, it is a coupe on the same tech, there definitely needs to be more separation in price. Finally other cars in the category (green cars) while not exactly the same have had cuts as well. The Leaf by Nissan saw price drops once American production started.

I don't know if the tax credit (7500) has a cutoff based on sales, previous incentives for some hybrids and diesels did. It most likely comes down to, we need to move these now, we need to get the numbers up to get better discounts, or just maybe the tech is maturing faster than expected.
I should think a Dunbar-compatible company size would be well under 150 – Dunbar's number suggests the total number of people an individual can relate to at any point, so unless most of the employees have no relationships outside the office, I'd start at under half that.

Incidentally, that would put the number around the 70 quoted in the grandparent comment.
> Do these, in our field, even exist anymore? (barring Yahoo)

Company dress codes and time tracking? They are pretty common outside of the startup culture. "No shorts and a collared shirt, please track your billable hours".
"Always get everything in writing. They offer you a verbal deal? Say not until we both sign it and its on paper. "

In cases where this can't be done or isn't practical the next best thing is being able to provide contemporaneous notes of conversations, dates and times with people you have spoken to. I don't mean to be a little old lady "what is your name?" or anything like that.

I've used these many times in the past (not in court because it never got to that) in order to get something from a higher up by building a credible case and trail of evidence. This is known as "memorializing" that is you take and keep notes which you can use at a later date.

This is not simply "well I spoke to Fred J. and he told me that..." it's keeping complete track of back and forth with various individuals and interactions what they said and when. Many times someone higher up will simply judge whether the events could have happened [1] and the person on the other side will not have exact notes (why would they?). In any case it has worked for me.

And if it gets to court you have at least a leg to stand on, sound like you have your act together, and can present at least a cohesive case of your version of the events.

[1] Edit: Important that you don't exaggerate. The person higher up will judge the validity of the entire exchanges by whether they feel the lower level person would possibly promise or say what you claim. The more it sounds like what you said happens could have happened the more likely you are to get what you want in the end.