skysight-inc/HackerNews huggingface dataset:
Danger Will Robinson---what? He doesn't code?

I shouldn't judge from a piecemeal HN post. But the picture I'm getting is "Know-it-all Javatecht VP of Enterprise AbstractFactoryCorporateWarfareObject Development."

Here's some news: there's no such thing as a CTO (or for that matter, CEO) in a four-perspn company. It's cargo-cult status-seeking: the CTO of $BIG_CORPORATE where I used to work was rich and important, so I'll give myself the same title and I will be too. What's missed is that the actual status comes from having humans to boss around. So in a startup titles are basically equity: worthless until we're profitable.

Fire the CTO. He doesn't code, he's causing problems. If you really need him for his experience with "Enterprise-ready," hire him on a consulting basis for a few hours a week to tell you what to google. But if he's not coding...what is he doing?
I love this idea and I'd be interested in backing something like this. However I do worry about the liability of something that is constantly in flux like the US tax code
I've tried the email > login flow, and my experience was that users hate having to check their email to log in. Power users didn't mind, because they often have their email very readily accessible at all times. It was much harder to convince average users that it wasn't an extra layer of effort (a perception problem).
On the upside, this might screw up the "campaign tracking" by counting the visits from HN as Twitter referrers.
>have no relation to GNOME? Really?

Yes, they have no relation to GNOME.

"A significant subset of GNOME users" running Firefox does not constitute a "relation to the development of GNOME". Neither does Linux being the "OS kernel that most GNOME installs run on".

There's not much interroperability (or need for such) between them. The Gnome team develops GNOME, the kernel team develops Linux and the Mozilla team develops Firefox, and that is that. At best, the Mozilla folks tried at times to adapt to the default GNOME themes etc. Not much besides that.

Now, Gnome and Gtk, that's a real development relation. Or Linux (kernel) and libc.
Hot And Just Listed In Broomfield
I heard Pascal is all the rage nowadays

Or a good, supported, still used and very stable language: Fortran.
Good god, why do these agencies not run on Linux or BSD? Think of the money that could be saved.

How is this a responsible use of taxpayer money?
Yes, but they do them differently. BeeHive is much more opinionated about the message (must be event and has an enveloper) and the Basic Data Structures.

Also BeeHive avoids stateful actors. State is always persistent in HA queues or Basic Data Structure stores.
I believe the formally validated alternatives have licenses that don't make them acceptable for a large part of the possible users.
What a great idea!

If they are already going to repaint all the lines, I would want something added to them that is electromagnetically visible too in order to help the autonomous cars be able to see the lines. I freely admit that tracking the other vehicles is by far the harder problem but it seems like the more digitally hospitable the environment is the more computing power can be used for the hard problems.
Can someone point to a source of what "cheap" solar material/panel they are talking about?
Windows 7 (and Vista) won't run on PCs without ACPI support in the bios. I don't know how prevalent these old PCs are in the government setting but its certainly affected some POS systems for some businesses.
4 Reasons To Quit Your Job [by jack Welch]
Live Streaming From International Space Station
I tend not to use the phrase "systems programming" any more. "General purpose" is probably better (or my current favourite "Pac-man complete"). I should probably edit the tutorial to that effect. We've done simple network protocols and packet formats (I had a student working on DNS for example) but not driver or kernel level things.

That said, some people are experimenting with lower level things (thinking about making a minimal run time system with no garbage collection for example). It's not a primary goal, but it'll be interesting to see what comes of it.
On SSD?
Official patches are more trustworthy in the enterprise and public service world. Whether those patches are better or worse is up for another debate.

You wouldn't want someone downloading random patches off the Internet or hiring a non-MS employee to make a patch without hiring multiple people to verify the integrity and usefulness of the patch (think backdoor) to fix computers handling your tax information. Do you?

I wouldn't.

You wouldn't download a random patch for heartbleed until openssl releases the official notice and patch. Or you won't download because you want the fix from your distro vendor.
Woah, hold on.

> sort of like two-factor authentication without the two-factor?

If you don't have 2-factor, which most sites don't, then it is 1-factor. This is replacing that 1-factor with another 1-factor.

> So how do I login to my email account for example if I need to login first to my email and get the temporary password? It's a chicken and egg problem.

You are taking him too literally. While he did say it could replace passwords, he obviously didn't mean email auth. Email auth would probably still require a password. Since many have their email password saved, they may not usually have to enter that anyway, most of the time.

> Somewhat flawed idea in theory, even more horrible in practice. I hope this doesn't become a real thing. I will refuse to use any site that implements this flawed passwordless solution.

You've not presented any valid argument against it. Why is it flawed? If it is horrible in practice then why do many companies use SMS as secondary auth (for the "2" in 2-factor)?
Has the hardware been improved or are they simply slowly rolling this out?
Akamai's "secure allocator" is broken and doesn't protect against heartbleed
This is an interesting article, I give you that. But you have to be realistic. The IRS patching security issues in Windows XP is about as realistic as my grandma building her own home automation iPhone app in objective C.
Prof. Van Roy gives a good example of this in the Edx course "Paradigms of Computer Programming" He uses the simple example of trying to introduce code to a pure functional program that will record the number of times a particular function is called. To do this you need to modify the signature of every function on the call stack. No doubt there's some other way to do this and it probably involves a monad but he was dealing with a simple pure functional language in the example. His point was that in this sense the pure system is not modular.
You can, just have a plugin that redefines the function to do nothing. I've only seen it on scripts that try to punish hotlinking by doing things like making console.log do nothing or redefining false to true, as it's obviously an example of worst practices.
Edit for down-voters: I'm not trolling/insulting (people who post on) internet boards. I'm hypothesizing that on most topics (esp. politically charged topics, which tend to rely on hard-to-assess factual claims), a high-quality argument for or against an opinion might require years of experience, and that often communicating that experience often requires journal-article-length explanations without drawn-out review processes governed by other experts. This is not an unreasonable possibility.

And if this is true, then the parent's idea might not be feasible. If it isn't true, then the parent might have a feasible idea. So... perhaps you could comment explaining why you're down-voting? I honestly don't understand.

(Also, the first sentence is just true... the venues I mentioned are nearly universally more informative than a comment board... srsly, not trolling.)

Original post:

If you want high-quality commentary all you need to do is get off the internet comment boards. These outlets exist. They are generally called journal articles, policy briefs, court opinions, etc.

> Rather than have new stories refine or even change arguments and their conclusions, most people on the internet just chase their tails in circles.

I think there's something deeper going on than a short memory span.

At some point (usually pretty quickly), you have to start either 1) making moral judgments, which is a whole branch of philosophy or 2) analyzing non-trivial factual claims.

To do this, you need people who are trained in science or well-read in philosophy/political science, depending on the topic. At that point, might as well just read journal articles in relevant fields.

The quality of argumentation on the internet might get a little better than it is today with good tools, but I don't think it can improve significantly. At some point you're asking for actual quality research (i.e. work), as opposed to armchair sophistry (i.e. fun).

> Even with those different value systems, it should be possible at some point to pick out the thought leaders across different spheres that transcend typical Republican, Democrat, Liberal, Conservative, Theist, Atheist labels with arguments that are acknowledged across the board as being internally consistent and factually based.

Maybe on some technical topics. But even academics and policy analysts often disagree along ideological lines.

> as being internally consistent and factually based.

These are both fairly low bars.
The major problem is that anyone over the age of probably 40 would be crippled by a migration to say Ubuntu. My parents still struggle with basic stuff on Windows even though they use it (Win7) everyday at work. Throwing something foreign at them would account for so many lost hours the initial cost would end up being extremely expensive.

Also Microsoft Office, basically MS's golden egg, is way farther ahead then Libre Office regardless of what people say. All of MS office's services integrate extremely well with each other as much as it pains me to say.

At the end of the day all these people need is Outlook, Word and XL which are leaps and bounds ahead of Libre Office, which doesn't even have a mail client.

Add in all the lobbyist and money going towards the right campaigns and there's your answer.
Are we required to get permission from a mugger to record him robbing us?
This might already exist, but a user management as a service provider focused on security.

I'm afraid that if I do a website and it is breached, all the users would suffer. Therefore I'd rather someone made a service that kept all sensitive user info, like email and password, separate from my webapp. The only way to access it would be via api over a unique user ID. Then I could worry about doing the website instead of about security.

EDIT: Also, one teamt would fix bugs such as heartbleed, and everyone using the service would be secure. It would eliminate the security risks of leaving an old side project running.
Willem Pinckaers on Akamai's flawed OpenSSL allocator patch
This isn't all bad news. The money to pay support and new machines will come from their "enforcement" budget. That's a win for taxpayers.
Let me make a suggestion - the next person you convince to start working with clojure ... hold their hand through the process and make notes of everything you had to tell them about (because they couldn't find it in the docs) ... then at the very least publish those notes.

One of the big problems is that it's -really- hard to go back and explain this stuff once you're already an expert, and I metaphorically burts into tears at your comment because if you'd documented all the things you had to learn the hard way as you went, you'd probably've gone a noticeable way towards fixing the problem you describe.

Note: I'm not, at all, trying to criticise you for not doing so. I'm just saying that if you could arrange for this to happen as you mentor somebody else it would be really really awesome :)
And the authority will often say "without proof, its just your word against theirs".
Well, this is pretty horrible! I'm not American, but that seems pretty stupid to me honestly. Google has enough power over people.
I hope it has because right now it is pretty unimpressive imo
3. And whatever other IRS-focused enterprise software they may be running, probably runs on the Windows platform.

Side note: Maybe this gets better in 10 years when lots of things have been written on the managed CLR? Although I don't think the challenge Wine has is running the C++ programs, but implementing all of the stubbed out APIs correctly... the same challenge exists with a C# interface.
'Dependently typed systems programming' was something that really excited me when I first learned of Idris, but it seems that they have backed down from that claim. Indeed, the home page now reads, "Idris is a general purpose pure functional programming language with dependent types".
2FA auth is still not supported by Bitbucket
Even if the solar modules are free, there is still a cost of equipment, land/roof, labor, soft-costs, etc.. And if the cost premium of tracking is outweighed by the the value of the increased production, then tracking will continue.

In short, there is no one-size-fits-all answer whether tracking is cost-effective now or with dramatically different module prices.
> Just from a UX perspective - security aspects aside - this is worse by a magnitude.

This is not true, clicking a link in an email, or copying a number from an sms is much easier than first logging into my password manager, finding the entry and then copy it into the field.

Also, this also works for apps as well, not just the browser.

Besides, password manager usage might still be quite low. So what the writer advocates is not less secure than having a single password for almost all their websites, like most people have.
Taiichi Ohno published the original "Toyota Production System: Beyond Large-Scale Manufacturing" in 1978 (the English translation was published in 1988), while Goldratt's "The Goal" was published in 1984.
> I should probably edit the tutorial to that effect.

Yes please do. Idris is a lovely language for bringing dependent types closer to the realm of production code, but giving people false hopes is a little cruel :)
Ask HN: Are HN comments ranked in a particular order?
Reminds me on an article about how short-term, market-driven university research is killing innovation in abstract fields with no apparent financial ROI (e.g. mathematics, physics, chemistry and biology).

If research was market-driven in 1859 Riemann might not had time to play with zeta functions because at the time no one knew what to do with them. Same for Bayes and so many others. It's not that those man had a better environment around them than current researchers, it's mostly that we're getting results slower than we might as a human kind.
> It's apparently not supported by Apache/nginx nor does a suitable software-HSM exist to use it, so you're basically writing both ends of the communication.

Apache/nginx don't have to support pkcs11, they just need to support the use of existing crypto libraries that already support pkcs11:

http://www.gnutls.org/manual/html_node/Using-a-PKCS11-token-...

If a server uses gnutls and passes the user-supplied filename directly to gnutls_certificate_set_x509_key_file2(), a PKCS#11 URL can be used directly without changes to the server.

> I just think forking off a process yourself is much cleaner for the use case of securing a web server.

It's something that everyone has to write for every server; people will get it wrong. Additionally, there's no support for hardware modules or plugging in new software security modules, so you'd be starting with a handicapped solution.
The writer is also incorrect about the nature of obsolescence. Something only becomes obsolete when a better system prevails and the old system falls out of use.

This has not happened, and if it ever does it probably won't look anything like what the author proposes.
Yup, that pretty much sums it up. I'm currently trying to figure out if dbus could be that serialisation since it takes care of a reasonable amount of the hard work for you. But I'm no expert on GObject, so slow going. (Also, I'm not sure that I'm the best person to be writing this... I don't really have that much security knowledge, I just spent a whole pile of time trying to figure out how to secure my (client) keys recently and wondered why we didn't do something sensible for server keys.
If your destroyers cost billions you've already lost the war.
I think it would be great for them to switch but I can think of 2 huge reasons they wouldn't.
1. Retraining the users, very few people use linux so it would be a massive undertaking to retrain their thousands of mostly non-technical workers to use a new, unfamiliar, operating systems.
2. Microsoft Office. Say what you want about LibreOffice and OpenOffice but when it comes to enterprise grade software MS Office is unrivalved, especially concerning Excel.

It would be much more expensive in terms of hours lost to make the switch.
See this page (https://github.com/idris-lang/Idris-dev/wiki/Erasure-by-usag...) for info on erasure. Unused proof values or indices in data types used for static checking are erased at compile time via usage analysis (if you don't use it in the RHS of a function definition, it gets erased).

If you want to ensure that the indices of your data type or arguments to your function are erased, you can use the new dot notation. E.g., if you give a function called "half" the following type

half : (n : Nat) -> .(pf : Even n) -> Nat

then the compiler will complain if the proof argument is actually used.
Are you sure? Searching for "side channel OpenSSL" reveals a majority of the attacks are against ECDSA. Of course, searches aren't the best measure of vulnerability, it's just an indication of popularity.
Fun part is that, if convicted, he'll stand to receive a punishment multiple orders of magnitude greater than the repercussions his tormenters stand (in terms of expectation values) to face, for even a single day of the abuses they suffered upon him.

Or for that matter, those faced by the administrators of his school for allowing the abuses to happen in the first place.
The best solution to cognitive capture is to make lobbying easy. If you make it hard to fight the status quo with money, you just make it harder to fight the status quo.
I'd like someone to implement a wrapper for youtube that makes using the website better.

There are lots of things you could do, from watching all of the videos since the one you last viewed, to a better way of editing playlists than the current one.

They should also make a way to preview videos, like hovering over the image of the video and you see a 15 or 30 second preview that you can choose from a part of the video.
There should also be a way to instantly switch from computer to phone/tablet, just like chromecast.

If you just open up YouTube right now you can see how many links you can choose, there is way too much clutter on the front page.

YouTube has a great opportunity to distinguish themselves from traditional media, but they keep making design choices that prevent this. YouTube has become the leading video service because they created a platform that differentiated from traditional media, yet the current trajectory doesn't fit with that.

Chad Hurley is also one of the few notable alumni from the Technology Student Association, an organization I am a current member of that has not benefited from the recent increase in STEM funding. It is quite unfortunate, because they have a much more diverse offering than other stem organisations, even having an open source software competition!
To be honest, I don't see how migrating to Linux would actually solve the problem the IRS is having. If anything, it would make the problem worse. Ubuntu LTS is only supported for 5 years on the desktop. RHEL goes up to 13 years, which is about how old Windows XP is right now. Windows or Linux, the IRS would have run into migration pain as support for its outdated operating system ended. Yes, if they'd used Linux, they would have had the possibility of backporting fixes. Realistically, though, very few organizations outside of the distros themselves backport kernel fixes. Instead of hearing about the IRS making extra payments to Microsoft, we'd be hearing about them making extra payments to Canonical or Red Hat.
I've been wanting this but with a little more functionality. The Email Link with a dropdown of up to 5 people I email the most, so that I can select one of them or more and email them something (the link of the page I'm on or additionally a select text from the page I'm on). No opening Gmail, no creating a new email, no subject line, no cutting and pasting of links/text, no hit send.
I think one thing you're missing is the extreme power imbalance in this situation: Rice is so successful and well-connected that it's inconceivable that this campaign could deprive her of her livelihood or materially change her historical reputation. At best, she'll lose a board position, which is just a lucrative side-gig, not a full-time job. I would argue that that well-known power imbalance makes it acceptable to "over-reach" slightly past your line (though still far short of violence) and call for things like removal from a specific position.

You're also mischaracterizing the nature of the boycott: the target whose behavior it's trying to change isn't Rice, it's Dropbox. And the goal is their policies around privacy, surveillance, and government cooperation. Rice is a seed that these issues can crystallize around, but anything that happens to her personally is sort of collateral damage.

At least that describes some principled support for this campaign. There may also be some that want her to personally suffer and don't care about Dropbox's policies.
>why do many companies use SMS as secondary auth (for the "2" in 2-factor)?

Because they don't know about TOTP or HOTP, and they instead decided to use a terribly insecure protocol as the basis for user authentication? The onus is on you to prove SMS is better than a shared secret + a nonce.
OpenSSL isn't last week's security problem: The code didn't magically get better in a week, and all signs indicate that there are likely more serious issues in the library.

Looking past OpenSSL, C didn't magically become a safe language in a week, either; this approach guards against a real problem in C that is not limited to a single bug in OpenSSL: over-reading off the end of a valid buffer.
The Dutch government also failed to complete the transition from XP to more recent versions of Windows on time. First the national government negotiated a deal with Microsoft for continued support of Windows XP (http://nos.nl/artikel/631811-rijk-betaalt-miljoenen-voor-xp....), then even the five largest municipalities negotiated a deal (http://nos.nl/artikel/633985-gemeentelijke-deal-met-microsof...) that allows other municipalities and provinces to join.
Sure. Everybody knows that federal employees are exempt from taxation.
They are paying per seat, the IRS is not paying for every single XP computer in the US.
I would love to see a UK Meshnet take off - however activity behind projects doesn't seem to be anywhere near the level of places like Seattle etc. which is a shame.

Would there be any issues with regards to attaching these devices to street lights? Who owns that infrastructure - the councils?