skysight-inc/HackerNews huggingface dataset:
Just looked up what kinds of things we do on our CI & CD:

- Run unit and casperjs/selenium UI tests

- Minimize and optimize JS and CSS files if necessary

- Add revision numbers to prevent caching on highly cached files

- Processing less files

- Closure compiler

- Grunt

- CDN cache clears or uploads

- Translation locale strings updates

- Deploying on servers

Tens of tasks/tests done in parallel and finished in 45 seconds.

The most important thing is by automating things, you are dramatically reducing possibility of making mistakes or forgetting something.
Pedantry, not really focused on you:

urandom is not too loose. There is exactly one Linux issue with urandom: it will service requests before the urandom pool is initialized. Linux distros work around this by trying to make sure urandom is initialized securely very early in the boot process.

Once urandom is initialized, the idea that it can ever "run out of entropy" is nonsensical; urandom is structurally the same as a stream cipher keystream generator, and we generally don't fret about whether AES-CTR keystreams will "run out of key". Nonetheless, the belief that urandom will sporadically "run out of entropy" is virulent.

The motivation behind the new system call has more to do with chroot environments, where the device might not be available at all. It's a good change; randomness should be provided by a system call and not a device. Unfortunately, by adding the flag, they've basically managed to add two system calls: getrandom and geturandom. >HEADDESK<
Remember Netflix? Homejoy (YC S10) increasing rates up to 75%
An email from Homejoy to customers. Current rate is $20 per hour.

Subject: Upcoming changes at Homejoy

Hi,

We at Homejoy are dedicated to making homes happier, both for our valued customers and community of Cleaning Professionals. After careful consideration, we have decided to make changes to our pricing. These changes will allow us to improve our service to you, while also supporting the stability and sustainability of our Cleaning Professional community.

What are the new rates?

* $25 per hour for recurring weekly or bi-weekly appointments

* $35 per hour for single or recurring appointments every 3 or 4 weeks

When does this apply?

* Appointments on or before August 31, 2014 will not be subject to the new rates

* Appointments on or after September 1, 2014 will be subject to the new rates

We are confident these changes will bring significant benefits to our customers and community of Cleaning Professionals. In the short-term, these changes will allow us to improve our platform to ensure we offer you the most seamless and convenient experience around. By reinforcing the long-term stability and commitment of our Cleaning Professional community, it will also allow us to attract and retain the most dedicated, verified Cleaning Professionals in your area. This will ultimately improve the standard and availability of our service to you.

If you have any questions, please contact us at support@homejoy.com. We are always delighted to hear from you.

With joy,

Adora Cheung
Co-Founder & CEO, Homejoy
"deplete the entropy pool" isn't really a meaningful phrase given the way the Linux /dev/{random,urandom} work. AFAIK /dev/random and /dev/urandom use the same CSPRNG (different instances) which is periodically reseeded with entropy gathered from the system (hw, interrupt timings, etc.), the only difference being that the /dev/random device blocks if an entropy estimator says that there's "too little entropy".

It's not that /dev/random has been "depleted" (which is meaningless given how a CSPRNG works), it's just that some entropy estimation code thinks that it might not be a source of perfect entropy/randomness at a particular time. (This practice is pretty questionable, hence the proposed new syscall.)
Explore your files one byte at a time with Syrup Trap File Explorer
Yeah, I don't run the entire suite either until the merge just before master. While I'm working on a branch I'm only running specific tests.

Having it build and run on a different machine could be valuable for certain applications.
Normally I pay for transit from my house to my ISPs peering points. And other service providers pay their ISPs for transit from their "houses" to the same peering points.

In this case Netflix is being forced to pay for transit from their "house" all the way to mine. Not how the internet normally works.
Not necessarily. Ubuntu have "enablement stacks" kernel updates for the LTS releases. These are more than just upstream patches.

For example, 12.04 LTS release had 12.04.4 with a backported kernel as a standard update.

https://wiki.ubuntu.com/PrecisePangolin/ReleaseNotes/ChangeS...
Heinz Zemanek, creator of the Mailüfterl, dies aged 94
From your link:

/dev/urandom is insecure. Always use /dev/random for cryptographic purposes.

Fact: /dev/urandom is the preferred source of cryptographic randomness on UNIX-like systems.

This seems to contradict your first point, which is that /dev/urandom is insecure in some situations. (Returning randomness without sufficient entropy is a security problem.)

Can urandom ever be used insecurely? Tptacek has said many times that you should just seed /dev/urandom from /dev/random, then never use /dev/random again: http://hn.algolia.com/#!/comment/forever/prefix/0/author%3At...

Is LibreSSL's situation different? If so, why?
I thought they were supposed to investigate crimes?

Not decide what cars can and cannot do because of their speculative thinking...
This is a good idea for sure.

I have a suggestion to make it even more powerful. Turn the mockups into a blog. This will benefit you in a few ways

1) You'll be able to grow your audience as a designer / consultant

2) It will provide you endless ways to pump out content to the audience you're building, allowing you to position yourself as an expert in your field and rank in search engines for terms related to UX design and design improvement.

3) You can do write ups on the blog which will be valuable to your following as you grow it and you'll start to get a reputation and more people will begin to approach you asking to design for them.

The above is a great long term way to demonstrate your skills and gather a network of peers in your field.

You could simply email the company the page of your website,

"Hello hope you don't mind,

I've taken a look at your website and I've used it as a case study for how I would improve it in order to benefit your conversion rates (whatever you guess their goals might be). I hope you like the publicity, perhaps you'd like to work together to make this happen?"

The above seems like a more credible way to go about this, you're giving them value for free, you're giving free and valuable information to an audience which demonstrates you care about the field and are keeping on the top of your game to your potential prospects. And you've got a handful of other example case studies that these prospects can look at demonstrating your ability to redesign things for businesses. Showing that you are the real deal and you have lots of good ideas. They will want a piece of your pie, most likely.
In UK when Ann calls Bob it is Ann who pays for the call. Bob doesn't pay anything. When Bob calls Ann it'll be Bob paying for the call.

Are you saying that in the US when Ann calls Bob that both Ann and Bob will be charged?
> - Run unit and casperjs/selenium UI tests

Of all of the steps you listed, this is the only step that actually pertains to CI. The rest are all part of deployment so they would fall under CD.
A realtime, platform-agnostic error logging and aggregation platform
How does this compare to, say, Tastypie?
I'm not really thrilled with the idea that you should use urandom to seed a CSPRNG; urandom should be your only CSPRNG. This most recent libressl kerfuffle is an illustration of why userspace CSPRNGs are a bad idea.
Journey and Flower were made by ThatGameCompany.

http://thatgamecompany.com/games/
It's worth adding that it does those things based on the output of previous jobs. Also, if you have many of these setups in parallel, it can create good dashboards and give you one nice (and free) GUI to take in the state of your build empire.
@wmf, OK, I did not know that background. But I can easily imagine that the AWS infrastructure is geographically diverse enough that Netflix is using Level3 only as a CDN, not as an NTP.
One year with Colemak
Keep reading the thread - Ted explains that decision.
Darkcoin, Dark Threat: Salvaging Cryptocurrency's Future
The last guy I knew who openly talked about CAPTCHA breaking tools got a can of whoop ass opened on him so I'd be careful if I was you.
From elsewhere on HN:

All of Netflix, in HD, on 24TB.

Netflix could solve the bandwidth problem by just mailing the whole library to customers. "Never underestimate the bandwidth of a station wagon full of magnetic tapes."
At least it is a form of "sharpening the saw" (to quote Covey). You are still in the mode of thinking about how to be a better worker.

There are a whole lot of time sinks on the internet that are much much worse ways of wasting time.
> you should consider posting an email as if you were the one newly responsible

For starters, I would not use the word "synthesized" in my email.
It's because so often they leave it reluctantly, hoping to finish it sometime in the future. I also think there's the gaming community in general has a culture that puts ideas on a pedestal as this great commodity that's inherently valuable.
in before JSC
New York state proposes sweeping Bitcoin regulations–and they’re strict
Oh the joy of not reading the thread.

> The getrandom(2) system call is a superset of getentropy(2).

> The reason for the additional flags is that I'm trying to solve more
problems than just getentropy()'s raison d'etre.

And you can implement getentropy(2) on top of getrandom(2) if you so desire, which they plan to do in glibc.

http://lists.openwall.net/linux-kernel/2014/07/17/682
Shouldn't it be Verizon paying level 3 to provide the access Verizon customers are paying for?
In my personal experience django rest is far easier & clear how do things. Also, the REST admin is nice.

I think is the closest in python to the (IMHO) best API-framework thing that I have used (http://www.remobjects.com).
It would only cost a small fraction of the money raised to prevent huge losses. Why shouldn't a project owner be obligated to spend a few percent of their total raised? The burden of logistics falls to the project owners. If they can't even be bothered to create and verify a project plan, then they don't deserve a single cent of the money they've raised anyway!
Pretty typical right? And your bank robbery getaway car could be orbiting the bank waiting for you to come out, etc etc. The report boils down to "gee a self driving car should would be useful to crooks." which is sort of obvious.

That said the benefits for non-crooks are a lot higher. And while roads in general benefit crooks getting away in cars, most of the people on them are just trying to get somewhere.
They can possibly be remotely controlled to lock the doors and drive to a police compound.

The BBC article fails to link to the report. The few details in the BBC report make me want to say "so much derp", because it really does sound dumb. But then maybe the full report is a lot better?
FYI, there is another fairly well-known open source project called Sentry:

http://sentry.incubator.apache.org/

Are they close enough to be considered a proper name clash? Not sure, but it's worth thinking about.
It seems like you're on a personal crusade against javascript.

In reality javascript is on by default for all major browser and you are a tiny fraction of 1% of all browser users that go out of your way to turn it off. I recommend you fix the problem on your end rather than rudely commenting on someones project.
Get on FlightAware and search routes between SE Asia and Europe. Many, if not most, go over Ukraine. Here's an example from a recent Singapore Airlines flight: http://flightaware.com/live/flight/SIA318/history/20140717/0...
You have to be good enough to keep your work queue as full as it needs to be to support your lifestyle.

I'd say you are pretty off base on what it takes to run a web consulting business if you are still thinking it has something to do with how good your technical skills are. Sales, sales, and more sales are the difference between successful consultancies (and most other businesses too).

So, what is your pitch, your niche and who you are pitching?
You're right; CI is pretty much a waste for a single person dev shop. But it's a godsend when working on larger projects: it centralizes processes that should ideally happen automatically, and increases developer confidence in the quality of the codebase by removing the deployment variables from the situation. Any team working on a reasonably large project should be using CI in some form.

For example, if you have a staging environment, and a developer pushes a change to that environment and wants you to make changes and test against his changes, you have to coordinate the deployment to make sure you don't overwrite his changes and vice versa. With CI, all check-ins would get automatically deployed to the staging environment using static scripts, so every deployment is exactly the same. It saves a lot of developer time, and removes the "which developer is a better sysadmin" variable from the equation.
That I can see. But I can also see a lot of today's hip things, like Node.js, not being terribly fun either at that kind of size.
This is scare-mongering, likely for the purpose of reducing privacy and personal rights in using autonomous vehicles for personal transportation.

There is enough open information regarding autonomous vehicles that anyone with disregard for safety could build an autonomous car bomb now. As with other supposed terror threats, the only thing preventing them is that nobody is doing it. But that doesn't sell anti-terrorism brainstorming consulting.
We used to use tcl expect before discovering pexpect. Cleaner syntax, fewer false positives, nothing but good experiences with pexpect.
not to mention, ground troops in a civ-war-like situation may not have the technology to detect a civilian aircraft's transponder, nor even expect one to be in the area (after all, it's more-or-less a war zone right now).
The third paragraph in the DESCRIPTION section of the manpage contains a lot of errors:

- "then the /dev/raundom pool will be used" -> should be /dev/urandom

- "Unlike reading from the /dev/urandom" -> author meant /dev/random

- "EGAIN" -> should be EAGAIN

- In fact the entire sentence "Unlike reading from /dev/random, [it either blocks or returns EAGAIN]" should be removed. This blocking/EAGAIN behavior is the same regardless if you read from random or urandom.
Yes, but it might be limiting if the app only worked on iPad. Other than that, designers who are pressed all the time to turn around early/draft mockups might find such an app very useful.
Stories like this are useful. Not for the details they contain, which are scant and make me think a lot of people in olved are stupid, but because they give "us" a chance to prepare for the inevitable accidents or criminal uses of this good tech. One day a child is going to be oilled by a self-driving car. That will be very sad for that one child, but we need to be able to point to the thousands of children who were not killed or maimed. Getting that message right seems important.
It you're in game development, you might want to take a look at haxe. It seems many users use it successfully for games.
This is not and has never been a technical problem. It is purely in the business and politics areas.

One way to see the conflict is that it is about what status verizon have - are they considered an end user isp or is it a transit provider? L3 is in the right if they should be considered the former, and Verizon is right if they should be the latter.
Further down, under "Not everything is perfect," the author addresses the problem with /dev/urandom never blocking.

Seeding /dev/urandom from /dev/random is a trick that can be used early in the boot sequence to ensure that /dev/urandom is henceforth secure. (In practice, distros carry over a seed from the previous boot which accomplishes the same effect.)
For prototyping could you use malloc without free? I have been rolling my own GC and wish that I would have left this until later.
I wouldn't mind seeing that; your data eclipses mine by about a lot.

Plotting your data on a world map would be kinda neat. D3.js is a good tool for that. Animate it over time for even more bonus points. :-)

Or, scrub your information from the data and post it for others to mess with.

I have several thousand entries for ssh, ssh-root, and spam abuse in my badhosts table.
For POTS, only the caller gets charged.

If you are using a cell phone or a satellite phone, you pay for your connection to that network, whether or not you started the call.

You certainly don't make it so that grandma using her POTS has to pay for the guy with the more expensive connection. That is viewed as extremely unfair.

OTOH, using the cell network generally has free calling to anywhere in the lower 48. It's not the old physical wires that are the expensive part, it's maintaining and upgrading all the cell towers, and so people pay for that usage. Once you've paid to connect your call to the wired network, you can do whatever within very wide geographic borders.
Also, the Pope is upset because unmarried people could have sex in the back seat while the car drives itself. There is really no end to the infinite possibilities.

>any hint of increased risk in any possible scenario amounts to mindless Luddite paranoia

Not any hint, but this particular one...yes. Dismissed out of hand. A get away driver (an idea that has been around for a very long time) would be far better than a computer that will stop for literally anything in front of it.

The FBI pushing such stupidity is embarrassing to me as an American. Next they'll report that if banks didn't have money they'd never get robbed.
1. "Absolutely nothing"? Let's not forget Microsoft was a huge player in mobile pre-iPhone, and many of the features we take for granted were innovated by them back then. The fact that Android just re-implemented them does not mean that the original innovations lost any value.

2. The oft-repeated "litigating instead of competing" meme is wrong. Windows Phone does compete on the merits. WP devices regularly get decent reviews. Most people who've tried them prefer the OS to Android. Personally I've seen WP work smoother on lower-specced hardware than Android on a more powerful device.

Windows Phone actually did something innovative when it came out and differentiated itself greatly from the the iPhone. Something that, you know, Android didn't bother with until Apple started suing left and right.

Arguably the only reason Android has the market share it has is because Google gives it away for free, because its search monopoly profits allow it to do so. When Microsoft did the same thing with browsers, they were being "anticompetitive", but when Google does it, it's not? If you think Google does not browbeat OEMs the way Microsoft did, look into the Skyhook lawsuit where a whole bunch of confidential licensing agreements spilled out.

3. If Google can attack Microsoft's business model, Microsoft can certainly attack Google's. People here just don't like Microsoft's attacks because they don't like patents in general. I mean, every patent ever is automatically deemed to be "broad" and "bogus", but nobody even knows how patents work.
There is no issue. Length extension requires the full (or as close to full as to make no difference) output of the hash function.

The problem with hash functions like SHA1,2 and MD5 is that their output represents their entire internal state.

In this case let's say an attacker recovered the password for door 1. They can then compute what the passwords associated with Door's whose number starts with 1.

As the password is substantially truncated, this does not represent the final state of the hash, and the attack is not useful.

That aside, this still suffers from weak key derivation, allowing a more direct bruteforce attack, as others have mentioned.
This. Completely this.

They may have a peer balancing agreement, which is not being held up, but they're also still being payed by their customers to provide access to content outside of their own network and Verizon is enforcing a limitation from another agreement (the peering agreement) that is affecting their ability to provide the content their customers want to have access to.

You can't have it both ways. Or... I guess you can, as Verizon has shown.
When I said "seed a CSPRNG" I was talking about the kernel seeding its own CSPRNG. I agree that just using the kernel's CSPRNG is the sanest solution to this mess.
It may be - reading this and the Guardian article it links to leads me to suspect the report is more along those lines.
Fuel savings coupled with a reasonable belief that no party in the conflict would've been expected to want to incur the international wrath resulting from shooting down an airliner.
The site and team simply aren't prepared for it.

I'm a fan of PH, but I don't think it's okay to change course on your answer here. Originally, it was closed to build a community with quality content. Now, it's closed due to scalability? Seems like your angle is changing due to pressure.
You are ignoring the very low-tech possibility that criminals may just hire a good driver. Cheaper and more reliable than hacking a very complex system.
"The Yogscast's Yogventures was the first Kickstarter I ever saw that set off alarm bells in my head"
What? Was this also the first Kickstarter the article author ever saw?
I think Verizon has an internal struggle. They are both a transit provider and an end-user isp. I think their transit role, which made this deal with Level3 for settlement-free peering, and its ISP role, which made deals with end users for high bandwidth, are fighting each other. We'll see if that plays out.
That's a neat way to do it, good stuff!
There's been a lot of papers about urandom being a broken pool. They need to adopt something like Fortuna or one of the more modern formalisms of Fortuna.
Why would it not also be their job to speculate on the way new technologies might affect their ability to investigate crimes?
I love PH, and admittedly use it more than HN (check it every morning, etc), but I'm curious to see how it can be turned into a business. To me it seems very similar to the idea of something like HN being turned into a business, which I don't see as a very logical idea.

Either way, I'm looking forward to seeing where YC takes Product Hunt.
OpenWRT adds IPv6, preps for IoT future
The downside of the cafe as your cubicle
How is this on page 3 with 344 points 4 hours in? Which moderator killed this? If this isn't news that people would want to know about I don't know what is.
Could submissions from Wired (& other sites which practice link-baity titles) be automatically put in a moderation queue? They wouldn't appear in the "New" queue until the title had been reviewed by a moderator, and fixed if appropriate. That sort of fix seems to be necessary a large fraction of the time. Regularly having such titles on the front page is a small but real hit to HN's quality.
The Internet is a crucial part of our infrastructure and a important backbone of our economy. If there is any indication that someone like Verizon in this case is tempering with it intentionally, they should be charged with terrorism. This is no different than someone going out and sabotaging Hoover damn on purpose. In fact it's worth!
Actually, they do (on that last point). Which is why Google Voice won't route calls to certain numbers. It's called a termination fee, which works like this: I pay my local phone company, and also pay a long distance carrier. When I call you, your local phone company charges the long distance carrier a fee, which that carrier then passes on to me. (Well, it used to work this way, but almost everything is flat rate now).