skysight-inc/HackerNews huggingface dataset:
Check my understanding?

So convertible debt isn't really debt-- it's an equity investment with deferred closing and terms. Right?

I can see then how this can lead to bad outcomes for the entrepreneur (behaves like a full ratchet if there's a cap) or bad outcomes for the investor (you've deferred the conversation and agreement on expectations). But at the same time it is in some ways simpler, and you get the cash immediately. Right?

Hmm... this is interesting. He suggests setting a price. So let's say I want to raise convertible debt... he's suggesting that one instead says "I'm raising one million at X" and sell convertible notes with a fixed price instead of a cap? What would that look like?
It is just impossibly more complicated than this. Financing a company with venture capital is no time to break out the folksy wisdom. "Well, it's just a loan with interest". Good lord, no.
Nginx-Clojure
Ha, I've setup the very same twimlet. My hangup was also the same as yours, I couldn't justify spending the time to figure out the, often confusing, API just to have no MMS still. I guess it's time to find some free time to hack one together!
> security and performance are hard

It's always been that way, and it always will be. I doubt a new library/platform will change that.

Sure it's hard and always will be. But the point is that C++ makes it harder than it needs to be. That's where Rust comes in.
Of interest to me:

"JVMs are not goot at huge memory management. Configurable multiple JVM instances (is the same number of Nginx Worker processes) will manage less memory. e.g. we have ten Nginx Worker processes in one Nginx instance every JVM instance will only manage 1/10 memory"
Delete Linux file at a specific time in future.
Not really. Gatekeepers of important open-source software are usually people who are known in the community and often employed by companies who work in the area.
> Generally with mature products this is true, so the solution is to use an immature product? Why not just take the time to learn the existing products so that you can experiment or make your changes.

It's not hard to experiment or make changes because they don't know the software, it's because the structure of the software is hard to change.

Sometimes the best way to move forward is to start new, using everything you've learned from previous projects.
idk why youre getting downvoted because it's a good question and people need to ask more security questions.

Any website I can inject malicious javascript into, I can steal your cookies from (assuming the httponly flag isn't set on the cookie).

If you were logged into one of these whois sites and they didnt have the httponly flag set on your auth cookie, an attacker could send you to a page on the site that contains malicious javascript that could phone home with your auth cookie, letting the attacker hijack your session.

You can defend your own websites from these kinds of attacks by setting up a Content Security Policy and using the 'httponly' flag on auth cookies.

http://en.wikipedia.org/wiki/Content_Security_Policy
You have summarized the perfect take-away from this article. Disclosure for bias: I am the 4th generation of an American manufacturer, that has survived for 100 years in New York City.

Of the hundreds of retail startups I have seen that are going to contract manufacturers, none have had a manufacturing expert or even one with any experience. In fact, it's severely undervalued with respect to importance. If they do have someone from manufacturing, they probably aren't being paid relative to their market scarcity.

The best manufacturers also design what they make, their own product, and do not make for others.

Apple has manufacturing experts and manufactures themselves, hence they control what they make. <startup-person class="random inexperienced" /> does not, so they cannot have their quality level, by definition. Hence, they pay more because they didn't capture the margin, and because they have to get in line to pay a contractor who knows how. But they cannot bring a serious order unless they are funded by deep pockets.

Here in America, we have lost most of our manufacturers, leaving three generations missing manufacturing experts. This is a no-brainer, obvious to all. However, the connection is rarely made that we have lost our manufacturing capability because /it is difficult/. It's so difficult it had to go to a highly efficient country with cut-throat competition, abundant labor supply, and abundant poverty. The perfect conditions for plunging down manufacturing costs.

Manufacturing is quite different from "making." We are having a resurgence of interest in making in this country, which is exceptional. Arduino is amazing! It manufactures for the people, not for other companies, reducing cost and providing access. Making doesn't scale without manufacturing expertise. I hope manufacturing is part of the renaissance as it grows.
> Just because something is old doesn't mean it's outdated.

Yes and no. The state of the world pre-2000 is very, very different than today. Pre-2000 engines were not built for HTML5/CSS3, they were not built for touch panels, they were not built for quad-core CPUs being standard (hell, dual-core wasn't really even a thing), GPUs were an unexpected surprise, not a cornerstone of the device.

You either refactor until you have nothing left from pre-2000 anyway, or you rewrite from scratch.

> It's always been that way, and it always will be.

No, it isn't, and no, it won't. Having security AND performance at the same time is hard, but Rust very much looks to be a compelling answer to that.
About 2):

Killing the canary does actually reveal the order, which violates at least the spirit of Section 215. Under the wrong circumstances, that could get you jail time.

On the other hand, making materially false statements after Sarbanes-Oxley can also get you jail time.

So yes, Apple could have realized that they had painted themselves into a corner that they really didn't want to be in. Having said all that, though, my money's still on 3).
It's an SPF record. By adding your authorized mail servers to your DNS, recipient mail servers can "verify" that a given server is supposed to sending mail for your domain.
It's very odd that they lead off by focusing on unrelated FUD.

> However, if people are indeed working to protect themselves, why are we still seeing incidents, breaches, and confusion?

That references a completely different security area, and as much as it's a juicy source of scare stories for mass media, it's unrelated to end user security with respect to government and corporate mass surveillance.

The former is basically insecure by design (based on the assumption that transactions are always reversible), with the duct tape occasionally failing. The latter will never manifest itself as a discrete problem for the sheer majority of people, but just an ever-growing set of annoyances and chilling effect on one's thoughts and actions.

They require completely different approaches. For the former simply having backup credit cards, being prepared to sue your banks for negligently giving away your money, and flagging the pop culture scare articles off Hacker News - that's about all you can do, because the deficient technology is not yours.

The latter requires proactively analyzing the implications of one's technology choices and avoiding the attractive nuisances. Fixing these problems is not at all straightforward and is one of the great struggles of our time, which is why it is such a disservice to conflate the two.
Google search explained: How to get traffic from Google [video]
Junk and grit and small areas are cheaper than "I would buy that" devices and open space.
Apparently part of the reason they hate it is that it sounds like complete gibberish to arabic speakers and the abbreviation is usually said in a very derogatory tone of voice.
that's bullshit. graeme wood has been covering prisons for years, and he's one of the best journalists in america.
Tally: Create tiny polls. No bullshit
because browsers in the 1990s were radically different to how they are today. Writing one from scratch lets you learn from past mistakes.

Its immature to start with, but if you have a reference engine (say gecko) and source test data (say the entire internet), you've got some pretty awesome tests already.

I am quite sure the people working on servo have got a lot more experience working with browser engines than most of us, and most of them are contributors to firefox/gecko. I would add that using servo, they manage to find several "bugs" in the new css specification that would have made parallelising CSS layouts much harder (due to servos inherently parallel nature)[1]

A new language that prevents some of the most common security issues via the typesystem will be more secure, whilst not sacrificing the low level performance of higher level language (like Java etc).

[1] - see this comment here: https://news.ycombinator.com/item?id=7484536
Would love to learn more about why these messages are failing for you. Reckon you could shoot us some of the failed SmsSids to help@twilio.com? I'd be much obliged.
These People Can Make Student Loans Disappear
Now if we could just get Google Voice to support it, that would be awesome.
How Gary Hart’s Downfall Forever Changed American Politics
Every argument in favor of the new term, that I have heard at least, is language agnostic. They apply in English just as well as they apply in French. I think it is therefore fair for me to offer my opinion on its use by English speaking media.

And yeah, my insincere proposal got somewhat neutered by a few iterations of making it less offensive to the innocent. I think my point came across though.
Yes definitely, but it'd be hard to edit out a guy looking around for the cameras, and IIRC there was an episode of Punked where exactly that happened and they got called out, someone shouted "where the fuck is Ashton?" and ran around until they found a camera man.

That was the main reason they stopped. There was a hidden camera show in the UK (all I remember is a guy with a huge phone shouting in awkward public places like a library) that the same happened. Their third season was in random places in Europe because they kept getting called out.
2017 Tesla Model 3 Starting Price: $50,000, According to a Sobering Report
iOS 8 adoption rate
You can live with it - it should just guide your product strategy. Moves that Tesla used with the Roadster:

- Start with the high end/low volume market.

- Minimize custom parts.

- Architect a completely different approach to change the cost equation. (Throw software at the problem instead of hardware.)
Google to require all app publishers with paid apps to have address on file
Modularity is good for restructuring, among other things. I'd rather type out a buttload of require() statements than have to try and de-couple parts of a monolithic system if I wanted to replace one part.

Also, static files should be a part of Express:

>Express 4 no longer depends on Connect, and removes all the built-in middleware from its core, except express.static
Oops, I didn't realize I was logged into abecedarius's account still on this machine. Reposting my inflammatory comment as me.
Bravo, I just embarrassed myself in a very quiet meeting.
It has nothing to to do with TXT record, it's just the website that render html. It could be any source.
I rather have the feeling there wasn't much there. All that new dystopian action movies are just the basic and shallow action movies we had with a distopian theme on it. I watched Elysium recently. You could have this without the SciFi part also.

I haven't seen a good dystopian movie in a long time. I was however also not very happy with Zero Theorem but they tried to do something different at least.

My relationship with Hollywood is this: I'm always happy they do something with SciFi. No matter how bad it is. People like SciFi atm and this brings money to ideas which also rises the chances of one really good movie. Then it all was worth it.

Same goes for TV shows. Black Mirror has been mentioned here. What a great show! But it was a great time for SciFi also. Look how many episodes Star Gate got. I couldn't watch it because it was so shallow but many people liked it and it was great for the genre.
> I honestly can't name any other ecosystem where you can just jump in and all these problems are already solved for you by the core project maintainers

I'm on the Dart team. We ship the SDK with a native VM, dart->js compiler, set of core libraries, package manager, and build system. There are canonical packages managed by the team for unittesting (using a Jasmine-style API) and logging.

I do have to admit the logging stuff isn't that baked, but the rest of the pieces are heavily used and have a lot of community-wide mindshare.

Not that I'm trying to steal any of Elixir's thunder here. I'm continually impressed by how polished everything they do looks. As someone who went through a language's 1.0 announcement, I really like how they clearly listed their compatibility expectations going forward.
I know of at least one instance where executives of a medical device company tried to ignore the FDA, and said executives got marched out the door in handcuffs. If the FDA can do that, I'm pretty sure the NSA can...
Mixing colors with HTML5 (phaser.io game)
Normally I feel the c++ standards committee has great ideas, however this is not one of them. If you want templated lambdas then you should use templates.
How large is it, ballpark?
Sinquefield Cup: One of the most amazing feats in chess history
It's related because it's not conventionally thought of as user input that needs to be sanitized (but, of course, it should be).
AFAICT, it reuses components of the Erlang compiler for emitting the actual BEAM code and instead targets an AST that the compiler makes use of. I believe the goal is to eventually target Core Erlang (a different but simpler language that Erlang can be compiled to, similar to Core Haskell). Other projects like LFE make use of Core Erlang already.
For making your life living hell in the name of overbearing security measures.
How big is it? If you put up a torrent I'll seed it...
One can imagine that I trust who.is and will click on links that go there, but now it can redirect me to an evil site that will attempt to exploit my browser.
Ah, the old "lie of omission" gambit.
Placemeter Raises a $6M Series A
Is there any reason why a company could not apply the same concept of a warrant canary on a user-by-user basis?

Imagine seeing a message every time you log into your Gmail account informing you that Google has never been compelled to surrender your private data to a law enforcement agency.
> Lying and not commenting are very, VERY different.

The Federal Government disgrees with you. Just one example:

https://www.google.com/webhp?#q=least%20untruthful%20manner%...
I wrote an app that has some GV-like functionality built on Twilio: https://www.getphonecard.net
Social network for rich people costs $9,000 to join
Yes, you need to install each extension on each browser / user account. It's basically just a one time setup hit, although one of the few I haven't automated away.

I currently use chromium but without any ad blocker, for viewing documentation and the like (and the occasional incognito window, especially for Amazon which loves to spam you based on searches)

I'm liking the idea of a per-machine setup, but I'd look into rewriting proxies (like privoxy) for that. I personally want every known ad/tracker/etc blocked without interaction - one person cannot hope to easily keep up with the machines are doing, but so far via crowdsourcing it seems like we can.
https://www.ncbi.nlm.nih.gov/pubmed/18556090, "Cephalic phase insulin release in healthy humans after taste stimulation?". The abstract ends, "In conclusion, the current data suggest that the sweeteners sucrose and saccharin activate a CPIR even when applied to the oral cavity only." Just, Pau, Engel, Hummel 2008. Appetite. 2008 Nov;51(3):622-7. doi: 10.1016/j.appet.2008.04.271. Epub 2008 May 10.

I appreciate that you posted a comment instead of just downoting. The fucking ignorant downvoting prick squad is a key reason that I mostly gave up commenting here.
Using Services to Keep Your Rails Controllers Clean and DRY
I use CryptSync on Windows to auto-encrypt/decrypt files between a folder outside and a folder inside my DropBox area. It uses 7z under the hood which is OK for most uses.

https://code.google.com/p/cryptsync/
I banned email at my startup
aaand we’ve never been happier. =)
Did you intentionally spell "developper" and "passionnate" incorrectly?
Ask HN: How to handle interview when you do not think like other programmers?
Throwaway account for obvious reasons. I've had a lifelong passion for coding. If I hit the lottery, I would be coding. Since about 4th grade, it's all I've known.

I've never felt that I had the same "goals" as other programmers. I like to make stuff that solves a real, concrete problem. I like it when my code runs for a long time and doesn't make any logic errors. I'm great at docs, debugging and code maintenance. I love to learn, but I love to make stuff work.

I'm really good at reverse-engineering. I'll use netstat to see who is talking to what, and on what ports, and at what times. I like to create documentation when it doesn't exist or it is wrong. I like to share what I've learned. I'll go to great lengths to get factual information.

I feel that I can do almost anything. If I don't know something, I'll go to great lengths to learn. If I need resources, I'll find them. But I struggle to get my knowledge, talents, and passion across to other programmers.

For example:

Interviewer: Tell me about a project you did.

Me:	I saw a need in our business. There was valuable data in a system that no one could get to. The data was of great use to the business if the right people could see it. I wrote a Java program that connects to <foo> API and loads the data into <bar> database. I wrote some PHP pages to display charts and graphs based on my knowledge of the business problem domain. I profiled my code for memory leaks. I made it very fault-tolerant. The code I wrote stayed up for months at a time. I wrote several layers of monitors for the application. I get paged immediately on my phone if anything goes wrong. Everyone was thrilled.

Interviewer: What version of Java did you use?

Me: 1.7

Interviewer:	Why didn't you use Java 1.8? It has lambda expressions. Why PHP? Why didn't you use AngularJS? Clearly you don't know how to code and are useless.

-----

I don't know how to "defend" myself when the interview goes this way. What should I do?
In which country's jurisdiction?
Its been more than a decade since I was an undergrad Materials Engineering student (I didn't even graduate in in that field), but I think the answer would be the same as for any coil. It is easy to elongate a compressed coil through deformation, but it is much harder to compress an elongated coil through deformation (while preserving the coil's properties...you can definitely smash one into a ball quite easily, but it no longer acts like a coil). With SMAs, there aren't two memories, there is a memory and a non-memory state. The non-memory state is like any other wire, deforming with physical force. In order for your proposal to work, you would have to take an elongated memory coil, and then physically deform it into a compressed coil to get the contracted state. That is a lot harder to do than to take an elongated coil and return it to a compressed memory state.
A voting system wouldn't get it right in 99.9% of the cases.
IANAL (and not an American citizen to begin with!) but most laws are formal, that's how they're compatible with "freedom". For a law to forbid you to do something, it has to describe what actions are exactly forbidden, in a fairly precise language.

A legal system can't let law enforcement officials decide after the fact what's permitted and what isn't (that's the theory anyway; your actual experience may vary widely).

So if a law forbids you to tell something, but doesn't explicitly forbid you to not tell another thing, the non-telling of which could potentially reveal the thing that's supposed to stay secret, then you can claim that you technically obeyed the letter of the law, if not its spirit.
The final words of executed death row inmates
Aaaand now I'm deaf :)
Gotta learn sign language
But it's already fairly obvious how it works.

It is obvious, and they effectively implemented a custom approach for PKCS11/ssh-agent. Yet the narrative implies some brilliant period of insight and innovation, when really it kind of isn't.

Which is where the "silly" notion that they must have did something novel came from -- their narrative claims it.
Do you have any evidence supporting your claims, contradicting what BBB and Angie's List say about how they operate?
I'm not using the API only the "see for yourself" link on the MMS page at https://www.twilio.com/mms.

Webpage says it's sent but nothing ever arrives to the phone. I'll send an email to help@twilio.com with my phone number if someone over there wants to try a few test sends for debug info.

As a side note I just tested using the SMS page and it seems to work now. When I last tried it a couple months ago when swapping SIMs and trying to test SMS it silently failed with both sets of phone numbers and SIM Cards while every other SMS source I could try worked fine. That appears to not be an issue anymore so it's just MMS.

MMS to and from the phone works fine with Verizon and AT&T cellphones so I'd imagine there is some plumbing somewhere going wrong in my case.

Thanks.
As tbassetto said, I can't see any reasons to use Underscore over Lo-Dash. Performance is on par or better, AMD/CommonJS modularity out of the gate, and their CLI can be used to build a minimal version of the lib based on the functions you need.

I wrote an article on how you can analyze source code and produce a minimal Lo-Dash build in only 73 characters: http://jjt.io/2014/07/18/analyzing-source-files-to-automatic...
Packaging is a product to be designed unto itself, especially as what you're usually ultimately selling is an experience. I think I've seen people rave about packaging I've designed as much as the products. And just like the product itself, manufacturing experience helps you hit a better price/performance note, all the way down to making boxes that fit in a certain USPS weight class which you can slap a mailing label on.
Why Neo4j and Cypher beat SQL for analyzing code smells
Introduction to Elixir 1.0.0 by Example – Part 1
Here's a youtube of the same documentary (A Murder of Crows) for folks outside the US:

http://www.youtube.com/watch?v=s472GjbLKQ4

Edit: anecdotally I've seen similar behavior and intelligence demonstrated by African Grey parrots (Psittacus erithacus)
Ah yes. The occasional click to confirm this or whitelist that, that's definitively "living hell".

It's the users' resistance to the slightest inconvenience that makes security so hard.
I agree that these are separate disciplines, but I think that one reason we're not seeing anyone who does security usability work well right now is that that the best practitioners in each field tend to be silo'd by their specialization.

A single assessment is not necessarily a single metric, and an assessment comprised of audits in each domain seems like a good first step toward building understanding of a common goal and measuring progress toward it. Putting these audits together will hopefully start to expose not only the tradeoffs, but also the synergies at play in designing secure systems.

It seems to me that at the root of the security usability problem is a failure in collaboration between developers with solid software engineering practices and designers with solid UX design practices. Talent on both sides is in high demand, but there are few organizations that are able to get both working together effectively on these hard problems.