skysight-inc/HackerNews huggingface dataset:
> you can't force people to sit down and talk nodejs with you if they want to drink instead.

Apparently, if you give most technical conference attendees the option (and venue, drinks, transport, etc), they will opt for going drinking in environments not suited for conversation. If this happens, I interpret it as a failure of the conference organizers. Why? Because their job is to organize a conference, not a party. If they want to leave some time for people to party (or pray, or go skinny-dipping, or windsurfing, etc.), then they can do so. However, to actively encourage people to be non-networking and to not talk (usefully) about the actual conference topic is, in my view, an anti-pattern of conferences.
These comparisons never work for me. There's literally no amount you could pay me that would make me willing to be a plumber or electrician, and I'm grateful every day that there are a subset of people out there who will do those jobs competently without completely bankrupting me.
Yes, NASA released research and related press releases in the past corresponding to new, unexpected data from Voyager that led to "[discovery of] a new region of the heliosphere that we had not realized was there" as well as "[leaving] researchers without a working model for the outer Solar System." [0]

Heaven forbid NASA do something as inconvenient as sending out a press release about its copious new discoveries in our solar system.

[0]: https://en.wikipedia.org/wiki/Voyager_1#Heliopause
There seems to be a lot of people that probably don't work well past 8 hours, and hate eating ramen, but brandish it as a point of pride, and there's a shared culture of misery that seem to imply that these things are necessary evils in order for startups to succeed. Kinda like a warrior charging off into a likely death bellowing, "For God and Country!"

I believe it was this martyrdom the author was attacking.
Tips for international webshops
Are you sure you can brute force the PIN?

Yep:

Elcomsoft iOS Forensic Toolkit[1]

* Instant passcode recovery for all iOS versions up to iOS 3

* Simple 4-digit iOS 4/5/6 passcodes recovered in 10-40 minutes

[1] http://www.elcomsoft.com/eift.html
I'm quite sure they could get prints off the phone or something else you've touched and make an artificial gelatin "finger" with the print. Depending on the scanner,this can work and is a well known way to fool some consumer-grade fingerprint scanners.
Startup Common Sense
> WHY doesn't NASA begin by establishing WHAT is it exactly that makes a solar system official "boundary" before producing press releases every time they find something interesting in the readings sent to them by Voyager.

Because discovering new things is actually more important than drawing arbitrary lines.
My apologies, I did not know it was completely separate. I had assumed it wasn't separate because that is what is listed as the reason for removing it.

This is quite unfair to you IMO...downright shameful of facebook to do this.
Microcode updates shouldn't effect the thermal integrity of the processor.

Microcode updates update a specific part of the processor that does a specific thing, i.e. the translation between the input ISA and the processor's native microcode instruction set, it's not supposed to be a wholesale update of processor parameters. (But we don't know enough about the structure of microcode updates to be certain. But I think you're barking up the wrong tree here and likely should read up on how Intel processors actually use microcode.)

You certainly can brick a CPU by updating parameters like that, but you wouldn't typically update parameters like that via a microcode update.
The Microsoft services are becoming a very tempting alternative to Google Apps.

Mostly I'm getting sick of Google randomly dropping services I use and re-designing every 3 months.

I was looking at fastmail.fm for my mail hosting, but now I'll have to check out outlook.com as well.
This is about confirming that their detection of the heliopause was in fact correct. Also, new data.

From the article:
Voyager 1 does not have a working plasma sensor, so scientists needed a different way to measure the spacecraft's plasma environment to make a definitive determination of its location. A coronal mass ejection, or a massive burst of solar wind and magnetic fields, that erupted from the sun in March 2012 provided scientists the data they needed. When this unexpected gift from the sun eventually arrived at Voyager 1's location 13 months later, in April 2013, the plasma around the spacecraft began to vibrate like a violin string. On April 9, Voyager 1's plasma wave instrument detected the movement. The pitch of the oscillations helped scientists determine the density of the plasma. The particular oscillations meant the spacecraft was bathed in plasma more than 40 times denser than what they had encountered in the outer layer of the heliosphere. Density of this sort is to be expected in interstellar space.
It's amazing how much someone can determine about a "secure" system by poking at it, doing differential attacks, and timing attacks. Anyone trying to build something secure should take warning from this, especially since there are much, much more determined attackers.

As someone reverse-engineering the Z-80, I find this article interesting. Maybe 35 years from now, someone will post a full analysis of how this Intel chip processes microcode internally, answering all the questions raised by this article. It will be very interesting to find out if there's anything malicious in any microcode patches. Are there checksums of the microcode so you can make sure you're not getting "special" microcode updates?

Reply to mrb: I expect 90% of the purpose of the signature is to protect against untested or corrupted updates getting installed. (It would be a support nightmare if people installed microcode with errors.) Protecting against deliberate attacks is probably secondary; I doubt you could do a nontrivial attack without inside help.
A Recap of Request Handling in Go
That was my thought too. No reason to buy AMC the cable channel since it makes zero content.

Just think, if you could reserve a theater, show some Netflix movie and split the proceeds.
Are Microgrids the Answer to City-Disrupting Disasters?
Whoa now... spoiler alert.
Story of Chimani, the Swiss Army Knife of Outdoor Apps
I believe the idea is that if the encryption key is protected with only 4-digits, you could brute-force it offline (if you cracked open the phone and de-soldered stuff). If the encryption key is protected with a secure passphrase (as, for example, PGP private keys typically are) then that attack becomes a lot less feasible.
The patterns that emerge for fraudulent orders are amazing. And, as the article notes, often specific to a particular merchant. Fraudulent orders often come in waves lasting up to several months, and pattern recognition can be particularly helpful in identifying parts of those longer waves.

I'm also working on a project in this space - http://www.merchantprotector.net
Several commenters are joking about how many times they've heard this before, but NASA goes into great detail about why it was so difficult to measure and what new information helped them decide for sure. Here's a small excerpt:

"The particular oscillations meant the spacecraft was bathed in plasma more than 40 times denser than what they had encountered in the outer layer of the heliosphere. Density of this sort is to be expected in interstellar space."

Read their account of how an "unexpected gift from the sun" helped them. It's not long and quite fascinating, and some little tidbits like this are pretty intriguing to me:

"By the time the signals get to Earth, they are a fraction of a billion-billionth of a watt."
A possibly unfortunate choice of name. I clicked the link expecting Sigil, the Epub editor.
Nope, too short. Also, The Google -> http://www.hillcountryexplorer.com/Locations/ShowLocation.as...
Before saying that your health is unlikely to suffer from a few years of banking hours, look at the sidebar in this exact article. It notes that four years of banking tends to produce chronic pain, auto-immune disease, and depression among other disorders.

It's not missing fingers and hands like you might have encountered in an early 20th century factory, but that absolutely sounds like long term health problems from a few years of banking work to me.
If the universe is continually expanding, does that mean we are trying to hit a moving target? Probably sounds like a stupid question, but I honestly want to know.

There was a xkcd comic about this @ http://xkcd.com/1189/
Brilliant! I wonder what kind of error messages LibreOffice embeds when it can't fetch a resource... could map out the internal network pretty quickly if it has distinct error messages.

Also docx files are zip files which opens the possibility of a zipbomb. I wonder if LibreOffice has protection for zipbombs.
This is beautiful. Best visualization on top of PLUTO data I've seen so far.
> 4-digit PINs are (presumably) brute-forceable

True, but iOS does have an option to wipe the phone after 10 unsuccessful PIN attempts. Given that iCloud backup is pretty simple to setup, there's no reason not to configure this option, IMO.
A little off-topic, but can someone tell me why fingerprint-access is even a needed feature? With PIN access, you get good enough security when you also enable the lock-after-10-mistypes. And 4-digits is only about a few seconds slower than fingerprint access...and since you already have instant access to incoming calls and to the camera, in what situations do we need insta-touch access to our phones?

Phones are getting stolen and compromised because people are too lazy to do the PIN thing, I suppose...but it never seemed like it was in Apple's best interest to make phones brickable.
literally every single comment here that talks about the quality of AMC shows is utterly irrelevant to this topic. AMC doesn't OWN any of these shows, they currently own the CABLE RIGHTS to those shows.

buying AMC is just buying a cable channel and those rights.

NOT a good move for netflix. they could simply start outbidding AMC/others for quality shows. oh wait, thats exactly what they've been doing....
WTF and Khosla go hand in hand.

Again, he can negotiate any way he pleases. Just don't pretend and market yourself as some great friend to founders. He's decidedly not.
Perhaps your idea of what a conference is, and what is well-suited for it, does not mesh with observed reality. Maybe that sort of conference just is not for you (I know your idea of a conference is not for me).

I've got to say though, even heavy drinking has never stopped me from having technical conversations with people, even in crowded bars...
Everyone seems to be moving from WebKit to Blink/Chromium. I wonder if / when Apple will be the only one using WebKit?

Slightly off topic: are there any desktop browsers that run on Linux or Windows that run an up to date version of webkit (for browser testing)?
Having talked with some Intel engineers about their microcode, they consider it a company secret that protects trade secrets about how their processors function and wouldn't say much of anything about it.

I suspect they would be slightly impressed that someone was able to find out as much as they did, but I don't think they would be overly surprised. I also suspect they would also be satisfied that this doesn't disclose anything sensitive about the contents of the microcode updates and just found out some information about the mechanism.

They definitely wouldn't be surprised that someone was probing microcode updates. A lot of us have asked them about it and they know people are interested about what's going on inside those blobs.

> I wonder if the handful of Intel engineers who presumably crafted this would ever stumble into this post.

They almost certainly will if they haven't already.
Although I could have expressed myself better, you still quoted me out of context. I was particularly talking about people dealing with less sleep on a relatively small timescale (less than 3 months). I'm choosing the 3 month window because it replicates the length of a college term and greatly reduces the risk of burnout (which I don't think is as big of an issue in college as in industry, because typical college schedules give at least a few weeks off after each term).

Are there any studies that compare how much people can done in a few months on different sleep schedules? I'm imagining some sort of cognitive task (like reading books and passing a comprehension test, or working through all the proofs in a math book) where the goal of the participants in the experiment is to accomplish said task as many times as possible in a fixed time period. This would be very difficult to design because one needs to decide on cognitive difficulty for the task (if the task was very easy, then less sleep = more time would almost certainly help) and have roughly equivalent ability between the 2 groups. This study wouldn't capture dealing with context switches or retention of information; just how much can be done in a fixed time period.

As far as I know, such a study doesn't exist. Anecdotally, I've seen many people make the decision to trade sleep for more time even while working on cognitively difficult tasks. Personally, I feel like I accomplished more during my terms in school than I could have sleeping 7+ hours/night.

On the other hand, I acknowledge long term sleep deprivation is not good for long term health, and I've personally seen my ability to run with intensity suffer during periods of low sleep.

In summary, I don't doubt the long term effects of low sleep on health, I slightly doubt the negative long term effects of sleep on productivity (know people who have been doing uberman for years and swear by it), and I heavily doubt that people can't be more productive over <3 month window by sleeping less than the recommended 8 hours per day.
I'm the lead developer at a tech startup in Silicon Valley and I interview about 2-3x a week. There is definitely a shortage of competent workers here. We will typically extend an offer to about 1 out of every 5 candidates because they just can't code or don't have the experience in the technologies we use. I've learned that resumes are very puffed up and that having a college degree really doesn't make much difference in terms of a candidate's competency. I disagree with the article about salaries being stagnate. In startups, especially for web developers, competition amongst companies is fierce and has driven up salaries.

Many studies use college degrees vs open positions as their data but I think this is a flawed model because what I have found is that college degrees and education / competency is only a loose correlation at best.
Numberwang: easily copy file names from shell command output
Eating hot peppers and reviewing video games
Yeah, I'm using full screen, but its not much of an improvement. I just want something along the lines of the old compose.
The way everyone's talking, you'd think Apple was taking away the four-digit PIN! But they're not...

The fingerprint ID is just another option, which you don't have to use.

So titles like this are just incorrect. Fingerprint ID isn't taking away any of your rights, because you can still use the PIN just like you always have.

I mean seriously, what the heck is going on here? Why on earth are people getting worked up about this? Sure, the fingerprint ID might be less secure, and it's important to realize that, but nobody's forcing you to use it. According to everything reported so far, the new iPhone is not removing your PIN.
I like to think that its not model view controller, but instead model-view-behavior (or the strategy pattern)

Events are a given. Models can fire/handle events, views can fire/handle events. The behavior/strategy pattern is just a bunch of singleton objects that know how to mediate between the view and the model. Sometimes the behavior pattern handles events (as a strategy), but it doesn't fire events (only the model and view can do that).

The model knows how to generate the behavior. The View contains the behavior and asks the behavior questions with the model.

This separates responsibilities nicely in my opinion.
by mo you mean no? :)
It's likely you would be dead before then. Voyager 1 after 36 years is about 127 AU away. The oort cloud is believed to be at least 50,000 AU away [0]. So you'll have to wait about another 14,000 years.

[0] - http://en.wikipedia.org/wiki/Oort_cloud
I'd love to see the full video of your demo, it looks cool!
I don't doubt that. Especially if you include assigned reading time. I have a 4th grader and they're expected to read 30 minutes a day out side of school and keep a log of that. Some teachers require them to write at least a paragraph each night explaining what they read. Add to that the normal math and/or writing worksheets and you can get to 50 minutes pretty easily.
That's exactly what I was thinking; to start, though, what about entering into the university sports broadcasting field?

If you broadcast every university sport, you'll get a large number of family, friends and fans of specific teams that are under-served with existing content. It's not worth the cost of creating a new channel for each, but it might be doable online.
> I'm of the opinion that people can adapt to less sleep.

Fortunately, we have facts about this, so we don't need opinions. Its not true, although it can appear true over short periods of time. More importantly, the amount of sleep a person needs can vary a lot between individuals - you might only need 6 hours/night, but that doesn't make it physically possible for everyone to survive like that.
Just above the diagram the author speaks about this:

"In addition to these operations, the subscription server may verify the intent of the subscriber by making an HTTP call to the provided callback with the same parameters requested before and an additional hub.challenge that must be echoed back by the subscriber."
Is there any kind of ratelimit on https://sigil.cupcake.io?
Nope, he hasn't except to know who to mess with. New founders get Bad Vinod. Experienced founders get Good Vinod.
Yes, those are the broad strokes. For that prize amount, you would probably have multiple teams applying for the prize and providing proof of their accomplishments, and the donors would then vote on whose project best accomplishes the prize's goals.
>>Finnish scores are constantly better than almost equally homogenous Norway.

Uh, considering the high immigration into Norway -- can you back that up? (Finland is more like the rest of the EU in immigration.)
I don't think getting a password out of a living brain is harder than removing a finger. Most brains would give you their password if you threaten to remove a finger, even more if you give a demo first and threaten to remove a second one.

In the case where the brain is dead, removing the finger is way easier.

I am not sure how that balances out, but I am sure two-factor authentication (fingerprint plus password) beats either.
That's because teachers come from the less gifted and higher education is seen as an unnecessary luxury. Importing science and technology is easier anyway...
Small Business Innovators - Totem Bags
That's true but also besides the point. As a banker, you can't schedule your work like a sensible person. The client asks a question one afternoon and you work late into the night so you can get him an answer by the morning. It's all about latency, not throughput. The question isn't: is this efficient? It's: will it kill you? And the answer is: almost certainly not.
Along the lines of what haberman says:

Most users don't care that their phone could be used against them in a court case. Maybe they should, but they don't, and pretending Fingerprint ID should be a form of two-factor authentication for your phones is silly. If users cared, they could use a passcode and the fifth amendment to protect them. It is far more likely for the average user to lose their phone by dropping it somewhere outside.

At this time, we can't even get most users to use one-factor authentication. Hell, the mass media perpetuates feel-good stories where kids use an unlocked lost phone to return it to their owners[0], so even with this technology you'll have a hell of a time convincing people to lock their phone with even a 4-digit PIN.

Stallman et al. have been telling us "your closed-source phone is spying on you" for years now, and it's clear that the education hurdle is far bigger than "fingerprints are self-incriminating". Just look the first half of the byline for [1] -- "The boy addicted to porn; the girl who let herself be sexually assaulted to get her BlackBerry back".

[0] http://www.huffingtonpost.com/2013/08/21/kids-find-phone_n_3... (original at http://www.kym4.com/4/post/2013/08/awesome-lost-found.html)

[1] http://www.theguardian.com/film/2013/sep/08/beeban-kidron-in... (posted as https://news.ycombinator.com/item?id=6373073)
I am under the assumption that most APs/Routers use 192.168.1.0/24 as the default network? I think it wouldn't be unique enough for use in fingerprinting.
Eyeballing the graph, if Finland has a 563 and Lichtenstein a 522, that's 7.9% higher.

The point of a graph is to convey information in a concise and useful manner. The pencil graph does no such thing; it obfuscates. It's objectively worse than giving the reader the actual numbers.

edit: That said, for any standardized tests, the scores generally don't follow a linear pattern. (From what I understand, they usually follow a normal distribution.) I don't know enough about PISA to even say what a 563 means, and neither does the vast majority of this thing's audience. Without more detail, even that 7.9% isn't helpful.
A locally organized Bayesian Data Analysis course on G+ hangout
Marketing isn't Advertising ... and it's not Evil
RDRAND wouldn't, the control unit would. Whenever it sees the XOR macroinstruction it checks the second operand to see if it's RDRAND. If so, it doesn't order an XOR; rather it just copies the RDRAND value to the first operand address.

That's the straightforward way of doing it. The 'finesse' would be to leave RDRAND as a secure random source, but in the case of it being used as an operand of XOR, simply to ignore RDRAND entirely, substituting an insecure stream. The advantage, other than reduced risk of detection, would be that asynchronous access to RDRAND wouldn't scramble the otherwise breakable output.
In case you were wondering, I descrambled the blanked out "png" files and the filenames were "jennymccarthy[01-04].png"
> In Finland, teachers are selected from the top 10% of college graduates.

I'm a Finn and I have three issues with that:

(A) I think high school would be a better translation for the upper secondary school, or gymnasium (1), in Finland. People usually graduate at age 19, and then apply to universities and other places.

(B) Well yes, the acceptance rates for B.Sc. and M.Sc. in education (to become a schoolteacher) are 5%–10%, but a lot of people, if not accepted, will reapply the next years, so this inflates the statistics.

(C) People who apply to study education, may not have been in the top 10% of their high school to begin with. (Some may have been, but a majority, no.)

(1) http://en.wikipedia.org/wiki/Gymnasium_(school)
I'm always sort of flabbergasted when I see PHP programmers doing this "maybe_xyz" stuff. I recall there's a PHP api for escaping stuff that has weird options for either allowing "double escaping" or ignoring successive invocations. It screams amateur hour to say "uh, i have a string, and I don't know if it's escaped yet, so I'll just call this API that escapes it because it magically avoids 'double escaping' for me." There's no such thing as "double escaping" -- it's just "escaping". The fact that you might be escaping something that appears to be an already-escaped string is irrelevant. If you are dealing with user input strings and you don't know for sure whether a string is escaped or not (or how many times), you are probably writing a security hole somewhere.
Biometric Scanners