skysight-inc/HackerNews huggingface dataset:
I think it's more likely to be a design decision. If you try to model a large real world area, some people will immediately notice how it is unlike reality; so the constraints of computational power, design skill, and developer ability are multiplied. The differences can be truly jarring.

My guess is that there is more upside to creating unique areas. This affords more creative freedom and the luxury of changing the simulation in accordance with constraints and resources.
Is there any way to run these scanners locally? For example, is there something blocking the ability to simply hook Gem Canary into say a git hook or similar local action, and checking Gemfile.lock with the scanning service?

I'm not super-comfortable connecting private Github repos to remote web services. Github's (and other applications) recent OAuth exploits aren't very comforting and I'm generally the paranoid type.
I don't understand... The article first analyzes apps that use a certain number of vulnerable gems. Sure, most of them are probably patched, but it doesn't change the fact that certain apps use old unpatched versions of these gems.

The second part focuses on historical vulnerability data for Ruby gems.

In what way any of it is misleading?
Future Apple devices may boast environmental sensor suite
Disassembling and understanding shellcode
Yeah, like I mentioned above the app I built (https://gemcanary.com) automates disclosure notification, and I believe? https://codeclimate.com/ may use the advisory database as well, but I do not know for a fact.

There's a few others but they've slipped my mind at the moment.

I use bundler-audit when performing security audits for clients. You could wrap it in a git commit hook and have it publish results, but to my knowledge no one's done it that way.
That blog post is the best explanation of how the Austrian economic philosophy applies to the current situation that I've ever seen.

Am I convinced that QE is a bad thing? No; I'll have to think about it. But at least I have some idea now of what the argument against it is.

(Like most of us, I'm no more than an armchair economist, but I do find it interesting.)
Fyi to those oh-so-lucky to be stuck on Windows systems, while nginx.org offers a 32 bit build, you can get yourself 64 bit build (no extra modules compiled) of the current releases, including 1.7, from http://kevinworthington.com/nginx-for-windows/.
Certificate revocation: Why browsers remain affected by Heartbleed
I'm ok with taxpayer money going on research, I'm less ok with those taxpayer money being used to feed company sitting on monopoly.
She just made herself completely unemployable, and she'll get sued for millions unless she can prove her allegations (and maybe even then).

She's very smart.
I can't speak to hardware, but there's certainly a certain similarity between occultism/esotericism and creating software - you have to be comfortable thinking about and working with things that, in a sense, don't exist. That doesn't mean they're not useful in their own way. It means that they don't have objective reality in the same way that a lake or a car or a building does.
Google Earth Enterprise. http://www.google.com/enterprise/mapsearth/products/earthent...

This doesn't come with the maps data itself, though.
Ask HN: how do you use your electric skateboard?
I recently purchased an electric skateboard (you can read about it here http://situationundercontrol.com/blog/2014/04/22/my-new-ride-an-e-glide-gt-powerboard/) and I'm curious about how other people use their boards. Do you mainly commute short distances, or just ride for fun? Also, what kind of board do you have and do you like it?

My commute is a little too dangerous for a skateboard (15+ miles on a two-lane road with very little shoulder), but I have a blast riding around town.

If you're in the Boulder, CO area, I'd be happy to compare boards!
Anonymous Reportedly Behind Cyber Attacks Against Children’s Hospital Website
Well yes, "flip side" implies a dichotomy. What's the middle-ground of a coin's faces?

It's not helpful to characterize alternatives as naive, ignorant, or Ludditic. The question is not one of naivety, but of actual policy, which is the stuff that affects all of us. How would the work of an outsider (or statutory redshirt) differ from a revolving-door candidate, one whose foundation is sell side? Seeing that we have a documented public history of the output of people in this role, what conclusions can we draw? Should the incestuous relationship merely be noted, as you do, before dispensing with alternatives?
Sorry to say, but I don't think the issue is a lack of a BS, but it's that your credential is from ITT. This isn't meant to be demeaning or derogatory, but ITT just isn't a highly regarded institution.
The most interesting example is Royal Dutch vs. Shell Transport. Both companies had equal shares in Shell Oil - Shell Transport was in the S&P 500, Royal Dutch was not, and sold for much less, despite having identical economic interests - until they finally merged in 2005.

When Yahoo was added to the S&P 500, its price jumped 24%.

The name for this anomaly is usually called the "index effect", and whether it affects valuation is controversial.
Is this idiomatic?

http://benchmarksgame.alioth.debian.org/u64q/program.php?tes...
No one ever wants to build, all a developer really wants is a type checker.
> Systemd has won by being vastly superior to any alternatives.

Systemd is better than Upstart, but it won in no small part due to politicking and strategically merging other projects that everyone else depends on.
Workaround: IFTTT provides an option to download a file to, for example, Dropbox (note: be aware of file size limit). One can use his/her server with script which streams video (or anything else) based on the source URL to make video/audio/whatever downloadable. Then Android device just syncs and voilà!
Vic did a pretty great job getting Google+ in decent shape, but am I the only one that finds the overall strategy among these properties confusing? I know that whenever I talk with a normal, non-tech civilian they are always confused by the service.

They have Youtube (where you can upload videos), Google+ Photos (where you can upload videos and stream as well), Google Drive (where you can also upload pictures and videos in addition to creating standalone Google Docs).

It would seem to make more sense to me that there should be a Drive where I store Photos, Videos and Documents, or there should be standalone Photos/Videos and then a separate service for Documents.

To me, these services should exist separately, but Google+ should bring them all together - meaning I can decide, from my photos/videos/documents what to post to Google+. If I want to post a video to the general public, I should post it to Youtube.

Obviously people may have different use cases (consumer vs. business) - but as someone using Google services as both a consumer and business, I find the tools confusing - and it seems to be even more confusing for my Mom.
Yep, totally agree, that's why I added a post scriptum :)
Bundler audit is entirely local; you install it as a gem, and it fetches a fresh copy of the database on its own.

Regarding Gemcanary, we're actually in the midst of building something just like that because we deeply hate storing Github tokens - but the ease of use was too good to not go for with our proof of concept. Once we release the new feature it'll be our goal to move as many people as possible away from giving us access to their private github repos.
I love that the HN version of kicking the tires is a battery of exploits.
Injecting 3D prints to increase speed/strength, and slash costs.
I believe [Code Climate](https://codeclimate.com/) will report vulnerable gem versions in your app. Their marketing page suggests that they also analyze how you use a vulnerable library to see if you're affected or not.
Its funny, in these countries communist parties are strong, the Maoists in Nepal have been staging armed uprisings for many years and there is still such strong labor exploitation.
Will there be a trillionaire in the 21st century?
High Fidelity System Architecture
make it useful first, social second.
Real Names is the best illustration of how Google tried to copy FB instead of offering a better one. "Circles"? only sound of it is already too high-brow for average Joe. Have you heard a taxi driver using word "circle" to describe his taxi driving buddies?
Really? Because they did that with WebKit. They made huge modifications to KHTML and KJS, released them back (admittedly in kind of an amateurish way at the start), and also open-sourced their proprietary component, WebKit, which wraps WebCore and JSCore up in a nice, manageable interface. They didn't have to, but they did.

They also have a lot of contributions to LLVM/Clang, as well as several other open-source projects.
Relevant: Mythbusting the Golden Mean

http://gurneyjourney.blogspot.ca/2013/01/mythbusting-golden-...

http://gurneyjourney.blogspot.com/2013/01/part-2-golden-mean...

http://gurneyjourney.blogspot.ca/2013/01/part-3-golden-mean-...

http://gurneyjourney.blogspot.ca/2013/01/part-4-golden-mean-...

http://gurneyjourney.blogspot.ca/2013/01/part-5-last-questio...
Totally agree that "real names" is a red herring. It irritated a small group of influential tech personalities, but as far as their influence may expand, it doesn't dictate which social network reigns supreme.

The reality is that once a service hits a certain critical mass it's almost impossible to extract. Facebook, like Windows, is now a permanent fixture in the tech community, and like Windows, it will only go away by slow, eventual deterioration made possible only by the gross incompetence of the company providing the software.

People don't care how much better your software is, the inertia will keep all but the most tech-savvy on the inferior solution as long as it provides basic semblances of expected functionality.
The detailed technical report in the header contains more technological details.
I won't complain about downvotes, but I would like to request a feature. In a manner similar to 'showdead', I'd like to be able to disable graying.

Here's why: when you gray out a comment to the point of illegibility, as is happening more and more, that only makes me want to read it more. So I end up paying more attention to downmodded comments, not less. Somehow, I don't think that's what you were going for.

I would rather have the option to judge comments on their content, and not their color.
Who would sue her? (I'd ask why you're a new account, created 5 minutes ago, but...)
New Sequel/Prequel to 50 Shades of Grey
A new book, entitled DUET stories A Chorus of Voices answers the questions that many reader had been asking themselves
That's actually a common misconception. There's no proof the proportions of Parthenon especially exhibit the golden ratio, neither do the proportions of the human body. Not to mention that there are so many body parts to compare to each other lengthwise, that it's inevitable some will end up close to 1.618.

According the Wikipedia article for the golden ratio, there's a few places where it might show, but nothing too conclusive. In my opinion, it's just make-belief, people want to believe in a mysterious and divine constant guiding nature. I don't know a lot about typography, but I see no reason whatsoever to use the golden ratio to determine the proportions between sizes.

1: http://measureofdoubt.com/2011/08/29/lies-and-legends-about-...
2: http://en.wikipedia.org/wiki/List_of_common_misconceptions#M...
Why not just call it what it is: sloppy journalism?

Ignoring the facts to further a pre-determined narrative would more commonly be called a lie.
This is a PR train wreck and so far every single thing I've seen about it has been "he said/she said".

These screen-shots (unless I'm missing something) don't show much of anything.
> I also think the real name policy is one of those things that we give too much weight too in analyzing the service. Lacking pseudonyms is not the reason "average" people have not used it.

I don't think that anyone will argue that pseudonyms are important to the average user. However, they are important to a small but influential group of users. The type of early adopter that otherwise could've driven G+ upward.
Iran's Untouchables: The Afghans
> "A lot of people would be shocked to find out that the space programme was founded by a man who held orgies in his Pasadena mansion."

If we had to kick every eccentric out of science there wouldn't be anyone left to invent anything. Might as well write Newton out of the history books too for 30 years of failed attempts at alchemy and occult research.
I think part of it is that people tend to separate things out into lots of gems. For example, if you're using Ember in your Rails app, that's two gems right there just for that library. If you want to allow delegated authentication with the common providers (Facebook, Twitter, OpenID), that's like 10 gems. Your unit testing and error reporting comes from gems, your app server is a gem, every database you want to support is at least one gem, etc. It gets explosive, but it's really just an organization thing. One thing to keep in mind, though, is that not all gems are actually used at a given time. Your gems for testing, development and production all go in the Gemfile, but you're probably not going to install all of them on one system.
In it's favor, a solar power satellite can get light nearly 100% of the time, while on the ground you are luck to average 50% with rotation and weather.
I'm sorry. I pasted all emoji's from the cheat sheet and it crashed...
in the software world powerful spell books are definitely real : http://www.lisperati.com/casting.html
Apple uses a lot of different technology than Linux does, though. Even down to their fileutils, cp, find, mv, chmod, etc. are all BSD-variants and not GNU; they ship with cURL and not wget; and they use/prefer LLVM/Clang over GCC, and so on.

They also ship software like OpenSSL, but they actively discourage its use in Mac software in favour of SecureTransport.

Don't get me wrong, they should give back (and they do), but it's kind of surprising how much of the standard Linux stack they don't actually ship.
It's entirely appropriate, this is a well-known exception to the general rule, much like the omission of an apostrophe on the possessive 'its.' Try reading it aloud and you'll see why.
> Sure, most of them are probably patched, but it doesn't change the fact that certain apps use old unpatched versions of these gems

Why is that news?? That is true across every and all software platforms.

> In what way any of it is misleading?

Because the article assumes or implies the conclusion that there are a huge number of vulnerable Rails apps. The only way to discover that is to not simply count how many CVEs have been issued for each gem, but how many systems in production have not been patched.

From the comments here, many people seem to assume this is an analysis of the number of unpatched vulnerable systems in production, which it most definitely is not.
The alternative to real names is not necessarily Youtube or 4chan. Reddit, HN, Fark, Mefi, Slashdot, and tons of other lard communities work fine with just usernames. The alternative to real names is moderation, policies, flagging/reporting etc. Abuse is always a problem in large communities regardless of real name or username policy and many different solutions exist for each type of abuse. Forcing real name usage was never the solution to any form of abuse.
Hi! Nicholas here. I'm not a doctor, and I don't diagnose Page in the story with any sort of disorder or condition. I just describe.
Yeah, Valleywag is on the list of autodead domains. Which is a shame, because they occasionally cover important stories.
Circles seems like a good idea - but I find I don't use them.
This seems to have turned somewhat juvenile at this point, I'm starting to lose more respect for people the more mud they've started slinging. (This doesn't just apply to Julie Horvath, Theresa seemed somewhat bitter in some of her posts but this article [0] does seem to come across as somewhat churlish

[0] http://valleywag.gawker.com/ims-and-email-support-allegation...
Thanks for saving me the trouble.

Microwave tech was awesome and cost effective until the first time the satellite got out of alignment and burned half the city down. I've been terrified of the idea ever since: you just can't make a weapon like that fail safe, and if you do manage, then your throughput is too low to make it worth it.
I just deleted the comment about the bangs. Really does read awkwardly.
You sir are a saint. Dealing with net_ldap and AD was the bane of my existence for a while.
One thing they do show is the HR rep not willing to be present in a meeting. That at least is evidence that their HR department should have been functioning better than it was. Not necessarily evidence of anything else, though.
What for? Apple discourages the use of OpenSSL[1] and instead use their own open source library[2] which also has an API present inside of Cocoa and iOS.

1: https://developer.apple.com/library/mac/documentation/securi...

2: http://opensource.apple.com/source/Security/Security-55471/
If it's not getting any traction, then is it good design? Facebook, eBay, Amazon, Reddit and Craigslist seem to be doing OK....
There are also great ("best") minds solving real problems in medicine/health.

They are just a trillion times harder/expensive than writing an app.
I think you write off FedEx and UPS too easily. They have a wealth of knowledge and infrastructure in this industry. When you talk about getting lost packages and so forth and that decreases your confidence, I find it hard to believe Amazon is going to perform so well that they don't make mistakes. I imagine they will likely make more than FedEx.
What does that mean the list of autodead domains, can it be posted in comments? can we look at this list?
Three Prong healthy approach when working in your home or office desk
Tech firms to fund open source projects following Heartbleed crisis
Can gnumeric run the "full" sheets at excel1040.com?
We could combine population controls with emigration incentives. If you want to have more than two kids, you can... on Mars. And here's a free ticket.
&what; – interactive reference of 14,500 HTML character entities
Such requirements are arbitrary and can easily be changed by Hacker News for the common benefit.

A rule "submit the original article, unless it's behind a paywall - in that case a copy/derivative is recommended" is reasonable and would be an improvement.
Why are you not brave enough to use your normal HN account, why hide?
FIPS support is such a rare requirement (and such an awful one) that I'm willing to bet LibreSSL, once it's 'finished' and buildable on the typical Linux system, will be gladly adopted by pretty much everyone who can. Distros will probably prefer LibreSSL whenever possible, with the exception of Debian, unless the licensing issue can be resolved (which I hope it is because GnuTLS is awful).

The vast majority of people who use OpenSSL don't need FIPS compliance, and LibreSSL will provide them with a more solid, better reviewed, more secure, lightweight, reliable drop-in replacement. It's hard to argue with that.
>Nothing is wrong with charging for add-ons, such as vector drawing and tweening libraries, but it sets the standard for others to charge for their code and is the complete opposite of the realm of the open Web, which everybody is trying to push forward.

I don't like it when companies complain about having to pay for code, assets, etc. Not everything should be open source, not everything should be free, sometimes people should be able to be paid for the work that they do for your benefit.
Do we have the numbers on what percentage of disclosed bugs are from Eastern Europe/"poor" countries? My guess is that gray-hat researchers take into consideration their likelihood of being caught when considering the bounty.

It would be interesting to know the percentage of people from less-developed countries who choose to claim bounties rather than exploit the bug vs. that of people in more-developed countries. I think you would probably find that fewer bug bounties are claimed by researchers in countries with less computer crime enforcement. I think you would also find that raising the payout for bug bounties would affect that likelihood.

Great thesis project for someone to work on.
370 million monthly active users. I wonder how many of those interact with Google+ by mere accident. Personally, the only time I post stuff on G+ is when I'm using another Google service (e.g. Youtube) and they post it to my G+ stream, often without my knowledge or consent.
The real-name policy itself was only known by a small group of people. However, the idea that G+ would be a place for a your One True Identity was directly attacking Facebook, which is not the way in which Facebook was vulnerable. If they had built the entire product (not just the real-name policy) around the idea of pseudonyms or ephemeral identities or multiple identities like Reddit, they may have found more success (but this may not have been aligned with their high-level organizational goals for building G+ in the first place).
Have you looked at DeepDyve [1]?

[1] http://www.deepdyve.com
Cyber gang leader Tony Colston-Hayter jailed for bank scam
I've been subjected to worse in the past, and I'm a male. I've seen other men subjected to worse. I know multiple people who left the tech industry altogether after suffering actual psychological abuse.

Regardless of everything else, her continued absurd attempts to link this to gender are disgusting, obviously ridiculous, and thoroughly demonstrate that she's not honestly interested in speaking for people who have suffered abuse by employers.
It continues to ask me for a username, even after I tried several of varying lengths with simple alphanumerics. I'm on Chrome for Android, FWIW.
> * Neighborhood locations to deliver packages to

In France we have such a system, "Point relais Kiala", not every internet shop allows it as an option but all the bigger ones do including amazon france.
I can get my delivery to about 5 different places within a 10 minutes walk radius of me, and the advantage are numerous: no need to be there for an entire to sign because they can't tell you when it will happen, no "you weren't there I put the notification paper and you have to get your package at the post office" (leaving the package in front is not a thing like it seems to be in the US), real ability to check your package before signing, more reliable delivery time, .... And cost is the same as a regular delivery.

It just is much better overall. And for Premium subscriber, it's free just like regular delivery options.
Here's a list from a few years ago:

https://news.ycombinator.com/item?id=499044
When it comes to groceries and other very time sensitive shipments then yes they should deliver on their own, but making your own nationwide to door delivery system would be a disaster. These are not easy businesses and it would be hard to beat the cost effectiveness of USPS, UPS and FedEx. They could start in fresh deliveries to limited markets and have those warehouses store commonly ordered products.

Currently Amazon most often uses a courier for only the final ground leg from a distribution center. They already have their own delivery to deliver inter-warehouse. It would not be possible to stock the huge variety of products available on Amazon in very local warehouses. So I would not be incredibly worried if I were a package carrier now. This could perhaps take some of the business in some markets but I doubt Amazon will go private for the majority of its deliveries.
I agree. A change from 47% to 56% isn't really a dramatic shift, and could represent only 1 or 2 companies difference with such a small sample size. Hard to draw any conclusions at all.