skysight-inc/HackerNews huggingface dataset:
FWIW I am more like you. I prefer to work with people like you and most of my colleagues are like this. However, when you are dealing with people that are NOT like this (and there are many of them out there), you have to change your game or get out of the game they are playing. It sucks but there are a great may people in the professional world that have no problem with conflict or that view "nice" people as weak people. Doesn't mean you have to change who you are but you would be well advised to change how you deal with this sort of person or they will walk all over you and not be bothered in the slightest by it.
I think the tweet they linked is real:
https://twitter.com/MaximeVerhagen/status/454342628822495233
Software eats software development
Haha, I think your idea is great, I just think it has unintended profiling consequences and is the sort of thing that justifies police overreach. Even compstat (crime tracking system that largely helped clean up NYC and then other US urban centers) is being intensely scrutinized for its role in driving profiling, harassment, and quota arrests in places that aren't war zones. The police aren't great at understanding how systems like this can be used to make people feel safer rather than feel oppressed.
This doesn't just happen in large companies. I've experienced this kind of useless gatekeeping with 50-100 person "startups".

I'm sometimes asked about tech hiring and I keep telling people that technical teams need to be responsible for technical recruiting. No one wants to hear that though.
Ask HN: Can employers own my work for a year after I stop working (internship)?
I just got an offer from a very large tech company (would prefer not to say which). There's a clause in the contract that says for a year after the internship ends, if I work on <i>anything</i> I have to send them written notice and evidence that the IP belongs to me.<p>Is this enforceable under California law? Would I be justified in asking them to remove this requirement?<p>I think the way it's written, it could even include work I do for class...
I suspect their patches are oriented toward paranoia. Their particular patch (keeping what they believed to be all critical values in a special region of memory used only for critical things) had no obvious necessity -- it didn't obviously provide more security -- but was just paranoia. Paranoia isn't always necessary, or even desirable; hence, the remainder of the patches have no obvious external utility, so they presumably haven't released them.
<p>
They may also have performance improvements, conceivably, and those have a more obvious rationale for keeping secret.
My resume is pretty well tweaked and has gotten positive feedback, so I don't think it's the problem. I think it's what you said: continuous learning and improvement. This last contract I was on kind of set me back skill-wise (but helped in some other, more meta areas), so I need to be really be conscious of making some commits for my own projects every day. Thank you for the encouragement, and great points!
That's awesome man, congrats! Thanks for the suggestions, they made a lot of sense and were helpful.
A growing business could easily find a sinecurial position for a founder that had outgrown his or her usefulness: the only reason to jettison this guy in such an amateur fashion is to avoid paying his salary or position him for dilution in future funding rounds.

My guess is that the CEO is dealing with investor pressure and the CTO has been parachuted in by whoever is funding them, likely on the understanding that future funding is contingent on making the hire and "improving the team". The fact that they are worried about keeping him on through the next round suggests that these promises aren't even reliable. In which case this is a malevolent power play and there is no good reason for him to roll over -- the most likely outcome of this all is that the company dies.

And either way -- this is a really horrible decision on the part of the CEO as well. Because what happens to HIM once his technical cofounder is gone? He'll be reliant on raising capital to fund an even more expensive team and won't even have the option of saying no and going back to running the business with the original team, something which is the most likely GOOD outcome for any small business and the only option that gives them any real leverage against outside investors.
The entire car is only about twice that, and we know the battery is very expensive. There's no way the electric motor costs $24k.
If you want "certified software", and this would not be a bad thing for many industries, that's entirely different than open-source software.
It's rare that I like something both as a joke and as a real feature request.
A small device that lets me piggyback off my friend's phone's battery if my battery is at 5% and theirs is at 99% and they can spare some charge cycles.
For anyone that wants to do this full time and work with a really cool team, shoot me an email: kevin@mattermark.com
you do realize that he was right and MS removed them right?
The New Mediocrity
Is western culture and its self centredness just sweeping the world with a new form of mediocrity?
I was curious, because I do agree that some of the flavor of job ads has changed, although I'd say more in the last few years. This was the second ad I opened on the SF CL: http://sfbay.craigslist.org/sby/sof/4419917236.html
I call it silly too. While also admiring many of its ideals.
I'm wondering how do you reconcile:

> Certificate revocation does not work. [...] OCSP is susceptible to a MitM attack (exactly the scenario in which you want it to work!).

with

> The only way to effectively revoke certificates in the numbers necessary after heartbleed is for the CAs to revoke their intermediary certs.

That is, how are the intermediate certificates supposed to be revoked if certificate revocation does not work relibably ?

Also, I'd note that certification revocation can be made to work by the browser simply refusing to continue if it's unable to check certification revocation status (either due to an active MITM or other genuine network errors). Granted this comes at the cost of great user inconvenience, but that's almost always the tradeoff with increased security.
> There's little more ignorant than an adult who still has an imaginary friend and insists he's real.

Oooh, can I argue the same way? I mean, by begging the question and arguing using ipse dixit?

Here goes:

There's little more ignorant than an adult who doesn't believe in God.
I feel like my experience is naturally pushing me to what you describe. I've been trying to look at not being able to get a job from that perspective. I love programming, and have the business understanding like you mention, so maybe that's the play.

Certain people I've worked with keep telling me to apply, apply, apply to jobs. But I feel like the rejection/frustration/disappointment ("Oh, we love you! Buuut, you're not good enough at TDD yet.") just hampers my longterm efforts.

Anyway, thanks for your thoughts!
It already is in many distros.
Chrome 34.0.1847.116 m Windows rejects it even with the "Check for server certificate revocation" _disabled_
Argh, my idea! I really need to start working on this, it's been bouncing around in my head for too long
He's definitely adamant about the ongoing exclusion of raw sockets on Windows and alleges malware would absolutely abuse it if it were available. He still talks about it once and a while and certainly does not regret that stance.
But you can use Python 3, it is your business if you decide you don't want to.
Python 3 will do the job, what is your argument against it?
On the basis that it is the size of a (very large) watermelon. What's it made of? Copper and steel and aluminum. $1000 of materials and $1000 in labor.

Here's a pic:
http://insideevs.com/wp-content/uploads/2014/12/Screen-Shot-...

Then of course there is the cost of the cooling jacket and the electronics. I can't estimate that readily.
Reddit-like meme humor belongs on Reddit.
These noncompetes are pretty standard, although they usually relate only to competing software / similar industries you may work on.

I once had an issue with one being too broad and asked for clarification and reduction of scope, they were happy to comply. They're mostly boilerplate and most places won't care / do anything with them, its usually just cover your ass stuff should some employee decide to rip-off their code base and sell it.

A year does seem a bit steep, not sure how it works there but here in oceania its usually around 6 months and limited by industry/market.

I'd also ask for them to remove the part about having to confirm IP ownership on everything you work on, its quite honestly none of their damn business.
Ukraine is broke. They owe Russia millions of dollars and have been living on pretty much free gas (courtesy of Russia).

I assume you live in US? Do you not find it ironic that you blame Russia for taking this seriously (in their own backyard) while US have been staging government coups within other countries (with multiple death tolls) for decades?

And in regards to corruption:

"People who live in glass houses shouldn't throw stones"

Perhaps you should focus on your own backyard first ;)
Good luck and if you want to chat about it my email is in my profile.
Isn't that userapp? I've never actually dug into it. https://www.userapp.io/
CommBank: What you need to know about heartbleed (responses in comments)
I don't expect this would be a company, but rather more of an open source project. I have been thinking about this for a while, so I'll throw it up to see if there is any interest. I would really like someone to create a website full of information and resources for first time startup employees regarding stock options.

It would be great if there was a calculator which would allow you to experiment with different liquidity outcomes given your existing/proposed stock options.

For example, you would be asked to enter the total number of outstanding shares, the number of shares you have now, the number of shares you are entitled to, your vesting schedule, if you have any acceleration upon change of control or other scenarios and if so how much, whether you have preferred vs common shares, liquidation preferences (if any), etc.

Once you enter all of the information that you have, the calculator can estimate how much you stand to make in certain scenarios. You could answer "How much does the company need to be bought for in order for my options to be worth $X?" or "If the company sold for $Y amount, how much would my options be worth?".

If certain pieces of information were not entered into the calculator, then it could show error messages and link to additional resources explaining why that particular number is so important.

I realize that the calculator would likely not be exact because of missing information and the complexities of each particular company's structure. However, I think in many cases it could be surprisingly accurate. The most important thing is that it be used as a tool to introduce important concepts and terms which new startup employees should research and understand.
Willem's letter to Akamai addressed three areas where their patch was likely insufficient:

(1) First question is then, are 'p', 'q' and 'd' the only sensitive parameters? NO. (The Chinese Remainder Theorem parameters are included in OpenSSL private keys by default and they are enough to recover the private key).

(2) Second question: Does OpenSSL ever copy the private key, or parts, after the key has been read? YES.

(3) Third question: Does OpenSSL allocate temporary variables for intermediates when performing operations with a private key. Can they be used to recover the private key? YES and YES.

(Willem's post submitted to HN: https://news.ycombinator.com/item?id=7582990 )

This update from Akamai only addresses (1), AFAICT.
I think if you show that you have considerable experience in the field and your past jobs held had the position as developer then it should make it easier, although don't quote me on this.
Even better -- there should just be some kind of flat tax or other very simple approach. 100 years from now, people are going to scoff at how ridiculously over-complex our tax systems were, and how much of our GDP was spent on it. (But alas, this is not an idea a couple of motivated hackers can implement).
If they had not released the patch, then it's entirely possible that black hats would have been able to make off with the keys from their customers - and that would have been a real disaster.
micropayments are hard. credit/debit card fees are proportionately astronomical. some day things will be better...
"The soldier's lot":

http://militera.lib.ru/research/suvorov12/07.html

is spot on! Been there.
Who are you and what did you do with the real joeyh? The real joeyh hopes for a chromium extension and switches to iceweasel in the interim.
Little background music while you read, Tovarich https://www.youtube.com/watch?v=rHomETco0MI
Worth pointing out that canvas already supports Bézier curves,

http://www.html5canvastutorials.com/tutorials/html5-canvas-b...

Is this different?
Google Announces Project Ara Developers Conference (April 15-16)
clara.io
On Picking A New Idea...
Envisioning an Apple iPhone 6 'phablet'
Some people don't see it as inevitable. They never want to change their code again, and they won't. But they don't want their code to be dead or unused. So what is most convenient for these people is for Python to stop changing.
Sounds like this CTO will have more support than you. Time to move on.

Don't understand why everyone is talking lawyers. I'm sure that you have an equity stake which value will be helped by this new CTO. If you have no equity and (as you say) are a founder, then you are out-of-luck and no legal magic can solve this. Move on and leave on good terms. You never know.
The biggest issue people have with python3 is unicode support. Unlike python2 python3 puts a clear distinction between characters and bytes. It also is quite strict about it.

The problem with 2.x scripts is that they mix characters with bytes quite often. This is not something that you can easily fix by a program, because from this perspective 2.x programs are broken and need to be fixed.

What you are suggesting is already available, python 2.x and 3.x can be installed and work side by side without any issues. There's even 3-to-2 conversion tool (converting backward is much easier than the other way since python3 is more strict).

The problem really comes down to distribution maintainers, for example we are talking about Guido extending support from 2015 to 2020 for Python 2.7. So before this announcement, Python 2.7 would no longer be supported in 2015, yet we have geniuses at RedHat still shipping it with Python2.6.

And no, there is no incompatibilities between 2.6 -> 2.7 as there's from 2.x to 3.x
"Our schedule takes what could be 12 days of adjusting down to four."

I've been flying overseas (+7 hour jump east) with my children since they were newborns. They've never needed 4 days to acclimate, much less 12. Everyone is on the new clock in 1-2 days eastbound and 2-3 days westbound. Where are these researchers getting their subjects?
Thats not bad... 1 year. I've seen 2-3 even 5 year non-competes.

If they are paying to make their product better not learn how to make a competing product. This is pretty standard.

However California is a "Right To Work" state and they can't keep you from working for a competitor. However, the next company you work for would also be liable if your stole IP from company 1. Just FYI... Knowledge of the Subject Matter OK... Specific Knowledge and Details of Products and Procedures Not OK.
"What webserver do you use in production?"

---------------------------

Passenger

2010 - 61.719%
2012 - 32.540% -29.179%

Thin

2010 - 9.483%
2012 - 10.675% 1.192%

Unicorn

2010 - 7.517%
2012 - 40.836% 33.319%

Other

2010 - 9.483%
2012 - 15.048% 5.565%

--------------------------

Anybody cares to explain why Passenger had such a fall in 2012 compared to a 33% user increase for Unicorn? If I remember correctly at that time everybody in the ruby community was blaming Unicorn, and there was a lot of effort to create more performant web app servers...
Not stupid at all. The same concerns and some bad experiences with 2/3 conflicts and deployment issues drove me to Go after investing quite a bit of time with Python, and I've not regretted it yet.

I'm not sure if it was something I did but I also occasionally found that when pip'ing Python 3 libraries with a lot of dependencies, occasionally some of them would actually be Python 2 libraries and things would break.
There's an easy way to do this already:

#! /usr/bin/env python2

vs

#! /usr/bin/env python3

Python allows you easily to run different versions side by side. There's really no good excuses.

Red Hat is major reason why the migration is so tough. They still ship with Python 2.6.
US Government Money Funded Cryptocat, Redphone, TextSecure, and Many More
Do you ever wonder where funding for popular encryption apps such as Cryptocat, Redphone, and TextSecure come from? Well, some of their funding actually comes from the US government. Click to read more about the interesting details.
Extensive hands-on experience in MPP DB's like Teradata, Greenplum, Netezza, etc and related utilities

Excellent hands-on experience building ETL jobs using ETL tools like Informatica, Talend, Ab Initio etc.

Bloody hell, that's a disaster. How do they ever hire anybody that way?
The rich are different than you and I; they have more money?
When I was something like 13, I went to my first computer trade show, where on vendor was touting tools that would let non-programmers write software for the minicomputers of the day, eliminating the need for those expensive programmer guys.

Ever since, I've seen people selling similar notions. Whether or not they work, I expect we'll see a number of similar tools on the market. As things like magnetic healing bracelets demonstrate, not actually working is no barrier to selling a product.
Why would their update need to address more than just (1)? That's the only part of the problem that they have to deal with. The OpenSSL team should be the one answering (2) and (3), since it's OpenSSL that copies the PK/parts after it's been read, or allocate temp vars for intermediates. If Akamai chooses to patch those two problems and then releases it to open source like their initial patch, then they can answer them, but otherwise, what's the point?
Something tells me you did not understand the above comment... He's saying the IRS could shift responsibility based on the fact they paid the worlds biggest software vendor 11mil... Switching to Linux puts the responsibility back in the IRS's court...
I agree with phantom, you will have to reduce quality soo much if you want to appeal to college students. 90% (from my experience) only care about free pizza and jobs.
Steve Gibson at it again.

Lots of exclamation points, all caps, and colored text, but not a lot of substance.

Chrome disabled cert revocation checks because they are easily bypassed: a MITM attacker can just block access to the CA's servers and the revocation check fails open. They instead opted for a more reliable method of pushing high profile revocations to the browser with software updates. These decisions are documented here:

https://www.imperialviolet.org/2012/02/05/crlsets.html

Notice how GRC doesn't give any actual details about how revocation checks are performed and the various advantages and disadvantages of doing them. In typical Gibson style, he is hyperbolic and cites no prior discussion. But of course these tactics do what they are designed to do: generate hysteria to get maximum page views.
OpenSpritz-iOS
There's nothing particularly wrong with his design, except for appropriating the terminology from the Actor model for what is basically CQRS.

You're just advocating for an imperative solution which may or may not be asynchronous. Nothing particularly wrong with that, but its not the only "right" way to do it. In point of fact, the underpinning of languages like Haskell is that state is conveyed by the arguments to functions (i.e. events), and the terminal "state" of a process is just the integration of those events over time or composition of functions. State is useful as a convenience. Its not essential.

Also, not for nothing, but oversimplified metaphors like shouting in an office are just obnoxious, and also irrelevant. Shouting might be a problem in an office. Software, it turns out, is capable of paying attention to whatever it wants to pay attention to and ignoring the rest.
i saw shai agassi speak for about 30 minutes in a TED talk and at the end of it, i still had absolutely no idea what his company actually did.
No really, The IRS will use something like Red Hat and the Red Hat Corporation will be providing a level of guarantee which the IRS can fall back on should they need to.

If they just pull patches from the community themselves, when something goes wrong they will have to take the blame themselves and people will think they are foolish being so reckless. As a techie, this option may seem feasible to you but then again you're just some random guy on HN who probably thinks node.js is the be all and end all of IT. I doubt you've got the intelligence (cleary) or the experience (very cleary) to understand how the IT industry works at a human, risk management and legal level.
CRL lists do not scale at all

Please elaborate. The CDP (CRL Distribution Point) allows for multiple strategies, some of which can scale quite well.

The Canadian government runs several PKIs with tens of thousands of active certs, many thousands of revoked, no problems at all, because of CDPs.

(Full disclosure: I worked for several years for the company that invented the CDP. I was not involved in the invention.)

(BTW, FF 28 detected the revoked cert just fine.)
Take advantage of heartbleed (POC)
The state is to blame, not people exercising their right to trade with each other. What a ridiculous concept.
I agree. Breaking down a debate into arguments which have moral and factual premises will be useful. The logical validity of the argument can be automatically enforced. The system wouldn't allow you to make an invalid argument.

Showing people exactly where they disagree would be a huge advancement. I think there are plenty of people who care about the truth and also care to have a consistent worldview in terms of morality.
You make a good point, but I think you attached the wrong conclusion.

This is definitely time-relative. But you could use light-painting to capture that.

Just add a dimension; brightness, color, size. It just, obviously, requires more time. It won't be perfect, but that wasn't even remotely the point here.
We use scraping to gather product prices from online shops for a price comparison site. I have permission from the sites who are not bothered to provide us with a price list other than their public website. Legal and necessary - so there is a market for this I believe, I am not sure about its size though.
All those tools you talk about still need to be maintained.

Anything built for "non-programmers" as you say, is also many orders of magnitude more complex, and at some point that complexity will grow to a point where it is cheaper to replace the whole system entirely rather than upgrade.

API's and stuff are easier on some level, but distributed systems are also much more complex. Upstream API's change, or get EOL'd or change license.

actually, instead of listing all the reasons : every point you made is just going to end up with more software being developed. it all feeds into itself. endlessly.
You missed the (IMO) greatest product ever: Apture http://techcrunch.com/2011/06/29/apture-hotspots/
Interesting. What I occasionally see from recruiters is almost a bit of the opposite.

e.g.

"Seeking Junior Ruby on Rails developer with 8+ years in C++, JavaScript,
Delphi, AnyLisp, MongoDB, NoSQL, API, Agile, MooseTalk, Apache, GoLang

Experience contributing to the Linux Kernel preferred"