skysight-inc/HackerNews huggingface dataset:
I'm really dismayed by this story, because it reminds me of too many conversations with young professionals who are stuck in their career because they are not professionally developing out of some inner rage. Quoting:

> "Amy admits she'll "never know" if she wasn't hired by Google because she's female, because she's not an engineer, or whether there was something else wrong with her application."

If you go through life believing that any prejudice (sexism, in this case) is dominating your career growth, you will always look for it in the tea leaves, project it onto any situation, and in return invite it. In truth, the person who is prejudiced is you.

You have to live your life assuming good faith unless you have direct evidence of bad faith. You're crippling yourself to assume an ethereal, non-specific, constant prejudice against you because you are putting the locus of control outside yourself.

http://meatballwiki.org/wiki/AssumeGoodFaith
http://en.wikipedia.org/wiki/Locus_of_control

In fact, in Amy's words:

> "I feel like I have no power, that this happened to me, and it’s my fault," she said. "I feel so betrayed. And, at this point, I don't really feel like I have it in me to fail again."

It's critical as a professional to believe that the situation is something specific, direct, and within you sphere of influence, so you can look to ways to improve.

In this situation, if you start with the assumption no one was being sexist, it's not that difficult to identify the most probable reason she was not hired and her salary was lower. Google acquihired the engineering team; she was a designer. Therefore, she was not hired.

If you see that as a cause, then it becomes easier to think of ways to improve, such as gaining software development skills or taking on a larger and larger product design roles to make yourself more valuable as an employee. Or just looking for another job.

Of course, they could have been sexist towards her, but the article doesn't provide direct evidence, only Amy's perception of their attitude, which I fully trust she believes is fact even though I also believe she is just projecting.

> "'Their attitude was, We can leave you with nothing because you’re a girl and you have a rich boyfriend,' she said."

The lesson in an nutshell is to never assume prejudice. Only draw that conclusion from direct evidence.
As of 2011: regular employees convert to contractors (red badges) and have 12 months to prove themselves. Obviously, executives get a sweetheart deal they arguably don't deserve.
(the post above has been largely copy-pasted from http://dmarc.org/faq.html#s_3)

Interesting point for the discussion on whether MLMs are allowed to modify the from header is in the section 3.6.2 of rfc 2822: http://tools.ietf.org/html/rfc2822#section-3.6.2. The intended meaning of the from field is to indicate the author of a message which is explicitly allowed to be different than the sender. Thus list-originated communication like digest messages should be sent with the from header of the list, but messages forwarded by the MLM should be sent with the from header indicating the original author. In the absence of the sender header it can be assumed to be the same as the from header. Thus, DMARC could use the sender header instead of the from header and fall back to the from header only when sender is absent. This way MLMs would have a way of avoiding the issue by supplying the sender header. Unfortunately, DMARC chose not to use the sender header citing abuse and bugs in some MUAs which don't display the sender header to the user correctly: http://www.ietf.org/mail-archive/web/dmarc/current/msg00064.....

As for the "Original Authentication Results" it doesn't solve the problem for most lists since it requires the destination domain to explicitly trust the list, see
http://www.dmarc.org/pipermail/dmarc-discuss/2012-February/0...
and
http://tools.ietf.org/id/draft-kucherawy-original-authres-00.... Few list admins could afford getting a trust explicitly established with every domain where the members happen to have mailboxes.
Plan pricing and the edge case
So what if someone tried to crowdfund a new implementation (or a thorough rewrite of OpenSSL, if that makes more sense). Could they raise something on the order of $1M? It seems like it would cost that much for, I'm guessing, three absolutely top developers for two years. Unlike a lot of crowdfunded projects, this one would not launch a business -- there's no additional revenue opportunity for the developers once it's completed -- so the amount would have to compensate them not just for their time but also for their opportunity cost.

On the other hand, given the importance of TLS to the Internet, $1M seems less than trivial -- literally pocket change, if the cost were well distributed among the millions of websites using SSL.

What do you think? Could it be done?
Samsung Sues Korean Newspaper For Misleading Claims
offtopic: do you have a trademark for the lolstartupland word? ;-)
The only thing I noticed, aside from secrets file and cookies etc that is outline in the notes, is that SimpleForm stopped working. Since project I was upgrading was small, I just removed it, but that is not option for bigger projects.
Hacker News Guidelines

Off-Topic: Most stories about politics, or crime, or sports, unless they're evidence of some interesting new phenomenon. Videos of pratfalls or disasters, or cute animal pictures. If they'd cover it on TV news, it's probably off-topic.
Tale from the front lines of dealing with the Heartbleed OpenSSL vulnerability
If the whiteboard is the central theme, why are you marketing to a capacitive screen? This is a sincere and humble question.
It's called the GPL. If that's really the model they're trying to create, it would be nice if they just used the GPL.
The average salary for a UX designer in Mountain View is 7% less than an engineer.

http://www.indeed.com/salary?q1=User+experience+designer&l1=...
Great. Thanks for sharing!
I've grown keenly aware of the gender disparities in tech and it's an issue I care about fixing.

Which is why I want the "tech undervalues non-coders" meme to stop getting dragged into these gender discrimination discussions. It muddies the waters and only serves to discredit the person bringing it up in the eyes of technology people who still need to be convinced that we have a gender discrimination problem.

A similar example I saw recently at (http://modelviewculture.com/pieces/sex-and-the-startup-men-w...) put it clearly:

"The roots of the vast gap in power and value between men and women in Silicon Valley begin very early in the life-cycle of a startup, often before the startup officially has employees or executives. For example, in a company like Facebook... women from the beginning of the company did work that had not yet been conceived or compensated as work. Women who casually dated the founders before the company had employees found themselves doing everything from recruiting engineers from their social networks, mediating founder relationships and disputes, providing product feedback, designing social events, and performing emotional and affective labor."

"When startups begin hiring employees, the fact that nontechnical work may have been originally done for free by friends often leads founders to continue to devalue that labor, considering it optional or “fun,” perhaps a matter of social obligation, rather than serious and valuable. Engineers become highly prized commodities to hunt and value highly, while labor that isn’t technical is often expected to be freely performed by people who may have other jobs at the company (such as administrators) or who may not have any job at the company at all (such as girlfriends and dates). And because this labor often goes underpaid or not paid at all, it also doesn’t signify when equity is divided up."

The author of that needs to ask: why can you find people to do the non-coding work for free or cheap, but you can't find people to do the coding for free or cheap? It has everything to do with the supply and demand of skills. Developers are still more scarce than all those other roles. Full stop.

We absolutely need more powerful women in tech -- by letting more women become great coders. Not by pretending coding ability doesn't matter.
> Interesting point for me is that those who serve over HTTP only are not vulnerable

...yes they are. You don't even need remote private key disclosure to MITM an http-only server. The way HTTP digest is written means you either store all passwords in a retrievable form or drop down to basic auth where anyone capable of base64 decoding can read all passwords.

This situation is by no means worse than if everyone had just used plain HTTP.
How Rigged is Vegas?
I would say that something like Code Red is an argument against putting up a web server when you don't need it and it provides no direct advantages to you, just out of some idea that increasing the overall amount of web traffic is good.
"I think the problem is that in the mind of the manager I attempted to plant in the head of the other employees ... that you shouldn't just give away what is in your head for some one else to benefit."

Well, isn't that what you tried to do, actually? After all, you did call them out in a public forum, and you're repeating your chosen themes here. Granted, they're bona fide idiots -- no argument there. But bona fide idiots are everywhere. So you smile, shrug, and go back to the $8/hr.-job that you need, or at least don't want to lose.

It sounds a little like you feel that you're entitled to something in some way. In theory, perhaps you are, but in reality the majority of the world gets bitch-slapped on a daily basis in one way or another, even (and sometimes especially) those you're sure are on top of it all. On one hand, you need that $8/hr., enough so that if you're fired, it's a real problem. You want to know if it's even legal! On the other hand, you're wanting to stand up for the dignity of your fellow workers against a management that, plainly from their behavior, could give a reverse flying shit. And they had the audacity to let you go?! Dude, seriously? Did you expect them to think about your point carefully, look at each other with chagrin, and then thank you for elevating the quality of the discourse?

If you need money, make money. Improve your situation and protect your baseline. That's the way you accumulate power. If you don't care about power (or security) and you just want to fight for what's right, then that's a valid choice and good for you, do that. But then expect what goes along with that.
You're in an at-will state, so unless you were fired due to a legally protected thing. (race, religion, sex, etc) You have no recourse. So it's legal.

It really sucks, and I'm personally sorry to hear that you had to work in such a crappy place and deal with such a demeaning and ridiculous situation.
I feel like just implementing pushState would be enough to solve almost all of these issues. Some simple design decisions could help with a few more of them.

I think saying flatly to not use infinite scroll lets me know that the writer doesn't have much technical skill. Rather, stating the current issues with infinite scroll and how to fix them is a million times more useful.
Google Play SSL Connection error – Google Play down - HeartBleed?
Don't blame the mice.
I don't think there's a 50/50 split. It's just that with a 2-party system like in the US, it's natural that they will roughly split the vote.
My question is completely off topic, but I have some questions regarding your site, if you don't mind answering:

How long have you been operating englishforums.com ? Is this your full time engagement?

How did you grow it to the 4 million+ number ? Was it purely organic or some paid advertising ?

And is the site profitable?

Thanks.
How hard would it be to develop a fast memory safe language that eliminates timing attacks?
I guess the point is that Haskell is more expressive and declarative, which makes this almost (not totally) the default behaviour of Haskell library developers. And I guess the resulting code would be easier to parse (by a human) because of its declarative nature. It would also be easier to test due to its functional pureness.

Whether that merits dumping the incredible amount of man hours that have gone into OpenSSL is debateable. I'd probably say it's worth fixing OpenSSL and trying to refactor it into a more provably sound system.
Learn You Some Erlang has a new chapter on maps for the occasion: http://learnyousomeerlang.com/maps
I think discourse handles this fantastically well!
This is neither art nor note taking, it's communication. :-) It's visual anchoring and gesturing - after the call's over you don't end up looking back at what you did almost at all.

We didn't know if the tech would work, but we have enough beta testers at this point that I'm pretty sure that it does.

Here's a video of a couple people talking some SICP.

https://www.youtube.com/watch?v=KrdjKvka558
Awareness and server-side adoption of fixes for issues at this level of criticality is not a problem our industry has.

I refer you back to this recent article, which was also discussed extensively here: http://arstechnica.com/security/2014/03/ancient-linux-server...

'Our industry' is not just the parts people are proud of, it includes a multide of craptacular bit players that nevertheless participate in the information economy.
Why heartbleed doesn't leak the private key
Those weren't custom operators in Haskell, they are part of the prelude.
https://code.google.com/p/chromium/issues/detail?id=361230
Except it's not. Those image loads start to bring a heavy memory hit. It especially stinks on mobile browsers.
Just tried and it worked for me?
I can't say I am surprised. Google probably needs about 1 designer for every 50 engineers. They could have given her a year though.
Chrome and Firefox both use NSS. I would assume that the big institutions looked at OpenSSL and decided their money would be better invested in other projects.
The Chromium team seems to have an all-or-nothing policy when it comes to security. c.f. https://code.google.com/p/chromium/issues/detail?id=53
Insider Threats vs the Customer (2013)
Heartbeep did, in theory, allow for millions of web users to have their credit cards, passwords, addresses, social security numbers, tax filings and more to be compromised.

Worse than "only in danger until patched", retroactively stored traffic is vulnerable if, like many sites, Perfect Forward Security wasn't used.

If the NSA took advantage of this at all, their logged traffic has become very useful...
It was developed outside the US at a time when the US had export restrictions on strong crypto. Now that those restrictions are gone, anybody can just use NSS instead.
The following is personal opinion/experience and I do not represent Google, etc.

My experience at Google is that we love hiring women both for SWE roles and PM roles. All three tech leads I've had over 2.5 years have been women, and I've worked with about as many female PMs as male ones. However, we generally hire PMs with a solid technical background (often a CS major or minor), which the author doesn't mention and so I assume does not have. I would be flabbergasted if she wasn't hired because she's a woman.
Number 1 is a bit thin-skinned, or I have been inadvertantly insulting a lot of people with well-funded, well-staffed "projects."
And it's like a parasite. It's takes everything from users for free but it never lets the outside world see the content without a Quora account.
Do you never change your salary unless it's by more than 12%?
The image felt very fake to me. If a spider were on my face, I would freak out internally, stand very still and slowly put my hand next to it to give it a way off so it doesn't bite my face.

If a spider landed on my face, I'd be flailing my arms back and forth trying to swat the spider away freaking out.

The neutral response is the proper one - if I saw someone screaming and standing still with a spider on their face, I would assume it is an actor.

What do I conclude from this study? Liberals spend much more time on the internet because they are more tech savvy as a community, and therefore have seen lots of "scary" pictures.
I've also submitted patches to OpenSSL and been entirely ignored[1]. The latest of which strictly improved testing, documentation and included a detailed study and write-up of actual bugs in OpenSSL and downstream code[2].

My conclusion was that the OpenSSL project is not interested in external contributions.

[1]: https://www.mail-archive.com/openssl-dev@openssl.org/msg3362...

[2]: http://jbp.io/2014/01/16/openssl-rand-api/
Fair enough, I guess I was hoping for the satire to be a bit more original. It was just the first episode though so I have some faith that there will be some more subtle humor as well later on.
Because they couldn't rent it out or AirBnB it the other 362 days of the year?
The #1 New Paid App In The Play Store is A Total Scam
> Mailing Lists don't have to forge or spoof to work.

Using email correctly per RFCs isn't "forging" or "spoofing".

That this doesn't work with DMARC because DMARC chose instead to break the world because it preferred to support the existing broken behavior over (rather than only as far as was consistent with also supporting) standardized, documented semantics of email headers is if not a fatal flaw in DMARC, at least something that greatly limits its utility.
I agree completely. If The Office and Parks & Rec had you laughing at the paper business, or town governance, they'd both be done after two episodes. But they give you nuanced characters that you laugh at and care about at the same time.

That said, I do wish Adam Scott were in this show - he'd be pretty great (esp. if you saw him in Party Down, where he played a character trapped in the catering industry).
Muut
https://www.coursera.org/course/recsys will provide you with a good introduction to the topic
'Heartbleed' Bug Shuts Down Canada's Tax Filing Site
"Big institutions" already did that. It's called NSS.
You said the (exact) same thing in the thread this blog post spun out from, and I didn't bother to challenge it, but I will now.

You're not being fair to IRC. IRC can just as easily give you a one-to-one relationship with another person who cares. Private messages exist, among other means. Moreover, the experience can be completely asynchronous. You don't have to both be available to make progress.

The main benefit of something like Understudy is to mediate the introduction of users to mentors. There is something to gain from a sustained conversation with the same mentor, but Understudy can make no more guarantees about the availability of your mentor than IRC can. Furthermore, that both the mentor and the mentee have to pay $5 if they're using the app more than two hours a month demolishes the potential userbase, not to mention that you also need an iOS device. IRC is multi-platform, free, and already attracts the sort of individuals that would be capable and willing to mentor users in something like SICP.
Neat; glad to see HSL values included!
;-) I kind of knew this already, but thanks for confirming. Point being, there's not a good reason "why" today. Truth is that it's convention at this point. People used to use maps and various tools to do navigation by sea and air. The methods they developed assumed certain things (traveling in an arc, usage of maps with lat/long lines, etc..), which meant the knot was more preferable.
Build a marketing fire
How To Get App Funding For Your Project, It's Easier Than You Think
It's huge risk mitigation. If they're a stand-alone provider, and one of their shows doesn't draw in the viewership it needs to, they immediately feel that.

But since they've got all this "free" money coming in through deals with various providers, there isn't an as immediate effect.
Apple's GOTO FAIL certainly also had a catchy name.
Spy-js: JavaScript tracing tool
Never mind. It seems Indians[1] are using Quora more than others :-)

[1] https://www.quora.com/Quora/Which-country-has-the-highest-nu...
The clinic scene seemed to do a decent job of it!
Anyone know if they hold any English/Dual Language events? I'm working for a Biotech startup in Osaka (www.quantumbiosystems.com) and am interested in getting to know the local startup community.

Actually, we're kind of interested in starting a hacker space in Osaka too as a bunch of people we've hired are from the Hacker/Maker/Open hardware community (Bunnie's novena is our embedded compute). If anyone knows of anyone else who might be interested in working on that please let me know (address is profile).
I haven't watched the show, but wasn't BWT a lossless compression with a smaller file size than anything else on the market? Or are they talking about comparing lossless to lossy?
Now I always wonder: if such simple creatures as ants can build such complex structures and are unbelievably successful as species, without any central body enforcing their behavior, why do we humans, need all those numerous laws and regulations that no human alone can fully comprehend? And why everyone believes we need central authority in order to achieve something? Ridiculous.
You can use these PPAs from our friend, Herbert: https://launchpad.net/~hvr/+archive/ghc/

They are packaged for Ubuntu, technically (12.04 Precise) but you can just add the apt-repository line to your `sources.list` and it will work fine, and plenty of people are doing this.

A repository for the STABLE branch will eventually appear on http://deb.haskell.org, but I'm not sure when Joachim will do this.
It's funny that you use "make the world a better place" -- that's one of the specific phrases (and attitudes) the show makes fun of.

"We're making the world a better place. By constructing elegant hierarchies for maximum code reuse and extensibility."

"Making the world a better place. Through minimal message-oriented transport layers."
Israeli startup says its device can charge your phone in 30 seconds
Facebook Hack Developer Day (livestream)
Yes. AI/cog sci could learn a lot from this. Intelligent structures are self-organized, the order isn't imposed from above or from some "central executive."
On the XKCD [0] you can find a spoof of the Tears in rain soliloquy. I never imagined it was rewritten on the night before shooting by Rutger Hauer.

[0] https://xkcd.com/1353/

[1] https://en.wikipedia.org/wiki/Tears_in_rain_soliloquy
Just because there isn't a consensus doesn't mean that issues are avoided.

Many questions do not have answers that two-thirds of the country can agree on. For small questions, perhaps that's harmful. However, for large questions, it's definitely a feature of the system that the electorate is forced to deliberate until wider agreement is reached.

Are there issue in particular that you think are important yet avoided?
What happened to NFS?
Back in the ye old days (~7 years ago) I was a co-founder of a small startup. Services like S3 and GitHub weren't commonplace, so one of the first things we did was buy a machine and install NFS on it. This was then our canonical repository for code and home directories. We found this to be very useful: pretty much everything was on the shared file system so accessing code, smallish (<1 TB) data files and executables was easy. The convenience of having files be instantly available and accessible from any program also really helped productivity.

Fast forward to today: many of my friends are involved with startups, and what I find surprising is that none of them use a shared file system: they get by with Dropbox and S3, but neither of these are really equivalent, and have their own annoying overheads. Sometimes this is unavoidable (say, if I don't have an office), but I'm curious if there are other reasons. Is it the (non-trivial) overhead of getting such a system going? Wanting access to the data in production? Do people consider using services like Amazon's Storage Gateway (https://aws.amazon.com/storagegateway/)?