skysight-inc/HackerNews huggingface dataset:
Subsidy and demand, you mean.
> Why even have a limited scope on bounty programs?

Theres a few reasons, most of them having to do with managing day to day operations and keeping the business operating, etc. It'd be great to have everything wide open and and getting hammered until anything resembling a vulnerability is found, but that is sadly not really practical in most businesses.

Most bounty hunters aren't using precision. Without a doubt some are very meticulous, but a great many will throw every possible tool/option at their disposal at an application. This is great if it finds bugs, but it can also cause a lot of problems if their script generates a few hundred thousand help desk tickets that put your support/sales team way behind at a crucial times.

Theres also a lot of politics thats come into play. A lot of times these bounty programs have a split fanbase within company management and anything that interrupts the business, causes "bad" PR, and such will be quickly pointed out as reasons why the program should be discontinued.

Bug bounties != pen tests. Penetration testing takes a lot more for teams to work with and get something out of, and honestly a lot of organizations don't get anything out of a pentest. They either get a vuln assessment that a scanner jockey exported to pdf and showed up in a sports coat to present, or if they get an actual pen test by some of the people really doing it they get their ass handed to them so badly they have no idea what to do.

Bounties are to help a company understand the problems they have and get them fixed. Pen testing is about seeing how well you respond when everything goes to hell around you. Smaller orgs being constantly beat down isn't going to let them get a lot done to do anything except put out fires. (beware, physical world analogy ahead) Learning to defend yourself involves working with an instructor, and constantly getting better, not paying someone to whip your ass daily until you can't stand. Some people can work through the latter and become very well adapted to mitigating the attacks, but most will just get beat down and quit.

Maybe Prezi was trying to take a stand by not paying the guy for being out of scope, and thats fine they're certainly dealing with the consequences of that decision, but its completely understandable as to why they'd want some sort of scope to begin with.
"I'd prefer a real solution to the JavaScript problem: put a real language in a web browser."

That's what motivated Google to create Dart, which just went 1.0
Paper and pencil. Don't constrain yourself with tools.
IntelliJ IDEA Ultimate brings you nearly all the feature that are available in the other version. PyCharm, WebStorm and others are cheaper but more focused on a single language.
In my experience the people who have fucked me over the most have been mean bastards who like fucking people over. Some of them have worn hats, but most of them didn't and some of the folk in hats have also helped me out and I suspect most of the mean bastards in hats were mean before they even got the hat and there are a fair amount of mean bastards wondering about anyway.
Yeah it seems like I'm better off just getting a used 4S.
Falcon 9 GEO Transfer Mission - Watch LIVE starting at 5:25 ET
I agree. The general mechanism is to push "control" of the situation and the punishment outside of the actual agents who are enacting punishment: under "zero-tolerance", it is no longer the arbitrary agency of the teachers and administration, but laws that "force" them to take these actions.

In situations where there is no "zero tolerance", there are still arbitrary and gross executions of power, but the agency behind this power can at least be (more) clearly traced to the actors behind it.
Thanks Jenn! Really glad you enjoyed it.
Note that Chrome for Android (and the desktop emulator) are very different than Safari on iOS. Even when they were both built on top of Webkit, they had different renderers and platform bindings (and the iOS binding was not open source, which caused some of the friction that caused the split). Now that Blink has forked from Webkit, they are diverging even further.

So while this means you can do basic mobile web development this way, testing that your UI generally works on mobile devices, it's not substitute for testing and developing on actual iOS Safari.
It would be really nice to send a dollar to a friend quickly and without any fee. Like cash, but electronic.

The current banking system has a built-in interest in preventing the existence of this kind of currency, so this kind of change would have to be propelled by government. It isn't likely that the Bitcoin community would be excited, but the rest of us would be.

Of course, they can't get healthcare.gov to work, so...
Ask HN:  Is there a company that makes dropshipping easy?
I've been looking around for a while and it still seems like an industry with many barriers to entry. You need to buy a directory for $300 just to find a list of dropshipping companies. I assume someone has found a way to make this easier - is their website just hard to find?
To be frank, this isn't some minor display bug, he had access your source.

In other words, this could have ended your company.

He could have sold or leaked it. If naivety is stopping you from grasping the possible consequences, then go ahead and read about Adobe's recent mishap.

You should be on your knees worshipping him.
And, even if they do eat them, if there's any significant variation in natural tolerance to acetaminophen among the snakes, you will just end up selecting for it and eventually this approach will stop working. Still, if it works, it's cheap and relatively harmless control for the short term.
1.3MW Solar Power Plant Being Built In Portugal
$0. If you become famous, people won't have trouble remembering any name you come up with.
Homeless Former Programmer Charges $2000/mo for 'Applied Homelessness Course'
Almost by definition, there is only a secure access continuum for known points of attack. Once you breach the access layer--no matter how it's done--the game is over.

- One copy of your data that is publicly writable is very insecure

- One copy with credentialed access is better

- Redundant copies with credentialed access and PK-signed master-slave synchronization is better still

- Add periodic off-site backups to encrypted media with keys generated using a hash-based one-time password and it's even better

But, oops! Someone left a debug line in the Javascript that runs your restore-from-backup webapp. The auth layer has been silently truncating passwords for the last 10 months to just 3 characters. All that extra security you entered to prevent anyone reading your dataset now means ... absolutely nothing. Anyone could have gotten in, and once they're in the backup app, they've got everything.

Beyond redundant copies to recover after malicious tampering, every single seal must be perfectly tight or you'll leak all your data. I've seen source code for some old Windows 98 malware (analyzed on MSDN, I think) and it's crazy how specific they are. One unchecked array index or untested struct size UINT before a memcpy is all it takes to do a privilege escalation.
While you are not wrong about this all being to accommodate for badly written code, I don't think that a programmer should specifically have to adapt there code for something as simple as substring() to accommodate for a flaw in the language implementation(memory leak).
>Don't build an engine that you will someday build a game on top of, because you will never get past step one.

I have several still-unfinished Game Maker apps which more or less died because I got so bogged down on the "engine". So yeah.
Dice roller for life/dnd
I don't have much personal investment in the story, I'm a significant consumer of music but haven't user Spotify (despite being in Canada I was only vaguely aware the service isn't available here).

They've taken some flak in the past for their payments to artists and while I'm not following the discussions closely enough to suggest those criticisms are unjustified it does seem that they're not the chief culprit. 30% retained doesn't on the face of it seem unreasonably high, does anyone know how this compares to equivalent services?

Ultimately I don't think disclosure is ever a bad thing and hope maybe this is one more small step advancing the general 'royalty model' conversation.
The example in TAL's podcast that really got me was the mixup between infant and child tylenol that resulted in the death of a child.

I've gotten in the habit (before I had children) of reading labels and understanding their contents, dosages and concentrations (if only for the amusement that there seems to be only a handful of drugs in boxes that typically take up several meters of store shelf space). However, the situation of the death of that child in the podcast wasn't out of the ordinary. Simple miscommunication between parent and doctor, and the lack of knowledge of how little acetaminophen you really need to overdose.

Specifying dosages as volumes of liquid is dangerous without knowledge of concentration. Better to specify mg of acetaminophen and let people work the math out (maybe that's asking too much).
It's not in any way about the article.

Are the effects of snakes in Guam not close enough for you? :)

Anyway being tangential or meta doesn't seem to be an unpopular thing in HN. Also, you can't flag comments. (Edit: Yes you can.)
would people stay for that? it seems like ads and spam always kill social networks in the end.
"but letting someone post for another year without telling them they are banned seems outright cruel - what is going on here exactly?"

There are of course several speculations for this that people can offer but perhaps you should post an "Ask PG" with that exact question.
This is less a matter of only writing what's needed, than having written the same thing in lots of different variations, until you know the essence of the problem, and which are the most elegant paths to take.

A beginner in any discipline can't accomplish so much with so little effort. And it's wrong for a beginner to start out trying to do so, IMO; it's too easy to get discouraged if you think from the start that you should be able to do it with so little effort.

Writing your first game loop is a bit clunky, trying to fit it in with whatever framework / language / API is hosting you, and the sequencing / setup of everything. The tenth time, you know exactly what you want from an API, and have a good idea of what bits you need to build to get the effect you need. The hundredth time, you can look at a new API / framework and see the what it enables you to build most efficiently, and you can let that inform the design of what you create. Then, very little effort is needed. But that's only because you've already done the "really complicated system for loading meshes and shaders" or some equivalent in the past.

It's hard to get really efficient without having done things the inefficient way to begin with, if not earlier in the current project, then in previous projects.
A Formula That Shows How to Cheat and Triumph at Tournaments
Misinformation. The E-1 and E-2 exist specifically for starting businesses in the US. H1B and even L-1 can also be used in some cases.
The would be protecting you from the volatility of the price of Bitcoin.

I propose that the value of the Fed's eDollar would be tied to the value of a paper dollar. This isn't a "mined coin", rather the Fed would issue eDollars the way it issues paper dollars.
Not at all. The pink doesn't bother me either. As long as she is happy that's the main thing. I just find it puzzling.
It sounds like npm quite easily can become a dependency hell where you have no idea whatsoever what code is actually being run.
Just watched it and his response is definitely not about the kind of FRP I'm talking about here, but seems to be criticising a specific interpretation of continuous FRP.

When asked what is the right direction he explicitly mentions that it's when all your data is immutable, which definitely applies to Javelin.
> totally, TOTALLY unnatural

Source?
because the studies I know usually show polyphasic sleep as the most natural, and wikipedia agrees (https://en.wikipedia.org/wiki/Segmented_sleep)

> nearly impossible to maintain for any length of time

crazy schedules like uberman, perhaps, but I know people that have been on everyman for years.

> possibly dangerous to your long-term well-being

So is monophasic sleep.

> Leave your circadian rhythms alone. You cannot redesign them or improve them.

Unless you can.
I just like thinking about how the snakes that survive will be a member of at least one of two groups:

* those that don't eat mice.

* those that are better at processing acetaminophen.

Also - what of the other scavenging animals?
Those are not the kind of customers you want, long term.
They definitely get accustomed, she is quite predictable in her time table and eating habits. It took a good couple months before she finally ate her first mouse. The brown tree snake in Guam appears to be quite the survivor and doesn't appear to be as picky. Still, from the little I do understand about snakes, the temperature of the food seems to play a major factor for them. That's where I'm most concerned about this plan failing.
What college for all model?

What we have is not college for all, not even close. We have capitalistic college education; where it costs as much as the market will bear, and the ability of the market is distorted by massive student loans which kids are told they have to get as it is an investment into their future.

College for all would be if college was free to every high school graduate, and costs were kept down by universities being run like places of learning and not capitalistic enterprises focused on football tickets and massive stadiums.
Great, so what do we do with them?

> Schools are being asked not just to educate but to parent.

I agree a hundred fold that schools are being asked to educate and parent. Latch-key kids do happen and are probably pretty common.

> If parents raise children who lack the basic skills required to function in civil society the burden can't and shouldn't fall on schools.

(emphasis mine)

Yeah, but it will. Now what?

Parents aren't going to step up. Or are they? How do they? With all that parents, both very rich and business-focused; and poor and very busy to make end's meet, that aren't able to properly care or don't want to care for their children, what do we do next? People aren't going to stop having kids for a LOT of reasons, and I don't think they should.

So, what's the next step. We can't just say "this sucks" and not provide some sort of next step. Maybe the first solution isn't sufficient, but what about the second? Third? Four hundred and thirty-second? An amalgamation of several? Unique per student per class?

It sucks, but we have to say more than "this is wrong" in these situations.

[edit: changed school per class to student per class]
You can use the OPT for this accelerator most likely, given it's related to your studies. What is your nationality?
One of the benefits to running a 1984 300D as my car. Only two wires going to the engine is glow plugs and the starter.

At one point I wanna drop an OM617 turbo engine in a small truck such as a ranger or s10. Gotta get money first.
Hilarious, plus I love Banksy's art, but flagged. I'm happy to see something that is not related to Bitcoin on the front page, but this isn't it.
Looks like it's $6.99 per delivery, not necessarily per package. Perhaps they can accept & store packages for a couple days, if you know you've got a string of them coming, and can wait until they're all at the luna wearhouse?
Simple and a life saver. I'll be signing up as soon as this comes to NYC.

I get most things shipped to the office to avoid sitting around at home, but sometimes you get an item that's just too big - those items also tend to be more expensive, making the $6.99 thing more palatable. I hope their numbers account for this effect (i.e., disproportionately large packages).

Dealing with USPS pickup slips is the sort of pain I wouldn't wish on my worst enemy.
UserVoice is DOWN
Oh, someone should tell the NSA that.
Amazon suggested this was intended to deliver within 30 minutes after the order. You are presumably, barring some kind of emergency, not going to be leaving your place after ordering this service. I don't think the intent of this is to replace the stuff you traditionally order through the mail/courier services over the span of days.
Rails 4.0.2 & 3.2.16 released - 5 new CVE's
Isn't that just failing to listen to the customers you talked to? As in, they got half of it right - they talked to customers. They just didn't get the listening part right.

In the case of wearable computing, customers didn't say they wanted to wear their phone on their arm or strap a phone to their heads. They wanted hands free, no fuss, error free access to information. Same market as stuff like Siri or Kinect. The problem is simply the implementation. Trying to tap on the little watch screen is god awful. Trying to get Siri to understand what you want as soon as you try to ask for something useful is almost impossible. The implementation falls down hard - hard enough to be unusable.

Same thing for mobile browsers. I remember really wanting a pocket version of internet explorer because of how useful it would be. Actually using it on the old Windows Mobile devices was basically impossible though because the implementation was terrible and unusable. Today however, I use my mobile phone's browser all the time because the implementation is good. There was nothing wrong with what I was asking for - quick pocket access to the web - but there was a lot wrong in what Microsoft thought I wanted - a handicapped version of their web browser that didn't work.

Talking is not listening or understanding. Wearable computing will definitely be a major hit once someone works out a good implementation.
I know this may be silly to suggest but isn't this just a processor pipelining problem? I feel like it's extremely likely that the loop with the extra call just lets the processor carry on better than a variable that it has to forcibly reload and store (to be compliant with volatile).

My assembly is a little rusty but I would just assume that the processor is blocking on memory and the waits just add up.
Yes, but that is after 2 or 3 post javascript related (javascript + javascript libraries) being upvoted everyday

My point is, there is a cult.. and thats what make the rating mechanism so unfair with other technologies that are not the mainstream ones

I saw it happening with Java, now its Javascript.. and soon will(probably) be Go

yet, they are all the same paradigm of C.. some sintax sugar here, some FP there.. yet.. same paradigm.. nothing that would make you create something never seen before in other language.. just more noise and vanity
Exactly. Because it was out of scope, he should find a competitor and sell the access to the the source code!!!! :-P
just a minor nitpick, but bitcoin is also fiat currency.
Thanks! Office deliveries are still a pain too, they sit at your desk because you're likely busy after work. Coming to NYC soon!
thanks, so basically you're hashing a token a each time a request comes in you decode.. do you increase the session expiration date or keep it as is?
It's just that sentences like "There certainly seems to be a grand coalition of people who want to attack Scala" and "why is everybody attacking Scala" struck me as a bit paranoid. Sure, there are people that tried doing Scala for a week or two, hated it and in their frustration wrote an angry blog post about how much Scala sucks, and they may very well be wrong. Still, this doesn't mean that there's some grand alliance against Scala.
Why Is Google Funding Grover Norquist, Heritage Action and ALEC?
I think the majority of such claims are misunderstandings of "generates downforce equal to its own weight" which is most certainly not enough to drive upside down.

The only case of a manufacturer actually wanting to perform a test was Gumpert with Apollo, according to Top Gear UK (take it FWIW).
Likewise, just because a right is not enumerated in the Constitution does not mean it is not a constitutional right under the federal constitution.
Before the days of time-sucking TVs and you-need-this prolific advertising and anything-anywhere-now product availability, people spent a lot of their time doing what they could with what they had. Radios out of scrap wire & fragmentary parts, goofy vehicles from whatever rods & panels available, toys from broken widgets, etc. "Lifehacking" was the norm. "Recycling" wasn't a different-colored trash bin, it was repurposing every part of everything conceivable; even food waste was turned into quality dirt. When a plane crashed near my great-grandparent's farm, they hauled the whole thing back to the farm and used every part of it. Partly out of frugal economic necessity, partly out of limited product availability, partly out of sheer raging boredom.

It's not so much that your teachers were crazy imaginative, it's that most people today are so freaking lazy and rich (while claiming overwork & poverty).
If I've resorted to "Libertardian" (and I do that fairly frequently) within a discussion, it's usually an indication that I've reached one of the many impasses I all-too-frequently encounter. And am indicating that Gish galloping, factual and logical errors, argumentum ad nauseum, and similar tactics, are all being indicated but won't be specifically addressed, simply because that serves no use.

As I said: my usual goal in those discussions is to see if there's any merit at all to either the arguments of, or discourse with, a specific person. I've yet to be convinced.

When I repeatedly call out an individual's failings (Noel Yap would be another G+ instance) and they never once apologize or admit error ... again, any last shred of respect has been lost. In his case I'd largely taken to deleting his idiotic comments to my own posts, and finally just blocked him -- the idiocy was too much to take. The icing in his case was repeatedly failing to read or comprehend the text directly before him to which he was responding.

When I make a glaring error, and am called on it, I admit it and appreciate the correction. I don't insist on being wrong.

What is it you perceive your job as?
College-for-all is fine, and probably an inevitable pursuit.

What's not working is the college administrative model.
"Useful" for somebody, sure. I don't think that fact has any use for the pubic.
Speaking of which, does Amazon batch Amazon.com deliveries with Amazon Fresh deliveries? Might make sense if you don't mind waiting an extra day for a package to get routed through Amazon Fresh's warehouse in exchange for knowing it'll be out in front of your door in the morning.
I agree with what you are saying 100%. Exactly what I have done in the past.

But I think that this might be harder for some people to do than others. That is to strike up a conversation with a complete stranger to gather intel. In a sense it's really social engineering. And it takes practice. Luckily there are plenty of places to stop into and to gain experience at no cost. No amount of reading (or Guy Kawasaki ismns) will get you to the same place.
You're really, really overthinking this. How much does it cost to assign a word to $SEO_PHRASE? Nothing. How much money magically flies out of their bank account whem they pick up the phone to talk to a customer? Nothing.

However, if they have someone on their payroll making $100k/yr and that employee spends a day with a customer gathering feedback about the product and what the customer would like to see going forward, that's going to be an opportunity cost of ~$300. It's just an investment. They aren't making money right now- they are spending money paying the (hopefully) right people to determine what they can do to (hopefully) maximize their viability later in the product's life.