skysight-inc/HackerNews huggingface dataset:
I work as a sales rep in-store for a telco. From a security perspective, it's ridiculous.

We use computer monitors which customers face from the same angle as us. I'm sure someone thought it would make the retail scenario more inclusive, but security-wise it's a mess. I can't verify account details without pulling up those same details for the customer to see. So I ask people for their details, click the button, and cross my fingers that they're right. If they're wrong, what then? They might legitimately not have known whose name it was under. It might be under their dad, mom, partner or business' name. Doesn't matter, the system has absolutely no design affordances to allow multiple people various levels of security privilege in accessing and altering accounts which are used by more than one person.

Furthermore, we have no organisational clarity about access privileges. Everyone makes up their own standards. Some people in the company are very strict, and won't do a SIM swap without photo ID or full ID over the phone. Some people will do one if the customer quotes the same last name and could be theoretically the account-holder's child. But does it matter when any customer can easily find out name, DOB and address from coming in store, then call up and get the SIM changed over the phone? We do have account PINs but very few people set them. And you could find it out in store if you were sharp-eyed.

There's a constant tension between providing a good customer experience and protecting security and privacy. But our commission is based partly on customer experience feedback scores - and if you're the one asshole who tries to follow all the rules (or follow what you decide should be the rules, because there aren't any haha) then you're gunna get a) bad feedback and b) alienate and make life difficult for the majority of ambiguous security events, which I'm sure are 95-99% trustworthy people.

Anyone relying on two-factor auth with a phone number who uses my company is vulnerable. Simple as that. It would take a determined attacker a day to get control of your number. All you'd notice was that your SIM stopped working. It would all be too late by the time you'd gotten a new one re-activated - and you're still vulnerable.

I'm not sure what telcos are like in other countries but I doubt much better.
I would fire all the moderators.
Business in the blood
Well, there's only one truth. It's perfectly plausible that one set of ideas (conservative ideas) could be less scientific than another set (liberal ideas).

However, ideology can influence us, since we are not perfect at science. Without the strong objective feedback of the hard sciences, social psychology is particularly vulnerable.

The bias alleged in this article actually starts to look more plausible when you consider the history of social psychology and related fields. Back in the 1970s, it was taboo to mention ANY innate qualities of human nature. Gender was purely a social construction. Babies were identical in every way--people were different only because of their upbringing. Prominent biologists like E.O. Wilson who argued genes might play a role were attacked and demonized. Nothing could contradict this doctrine of the blank slate -- that we're born perfectly malleable. I highly recommend Steven Pinker's 2002 book, titled "The Blank Slate" [0] which brilliantly debunks this theory, and lays out the best characterization of human nature I've ever come across. Seriously, read this book, it is a masterpiece.

Anyway, from what I've read recently, it seems many fields like social psychology are still captive to lesser versions of the blank slate fallacy. Human nature is not as malleable as they think. Our instincts are still there (gotta eat, sleep, procreate), and even "higher" areas of the brain for things like language, emotion, and thought seem to be heavily innate (to think at all requires machinery, and there are many ways to craft that machinery). Also, genes really are more important than most seem to realize. The twin and adoption studies show that the majority of variation among people in intelligence and personality is due to genes. How your parents treated you and brought you up has almost no effect by the time you are an adult in important metrics like IQ and personality tests. Smart people are largely born smart.

These sort of "deterministic" ideas fly in the face of traditional liberal values. Topics like gender discrimination and societal inequality are undermined by these ideas, so that provides a reason for a liberal thinker to push back against them.

If the gender gap in computer science is due more to innate differences in interest than to discrimination, and if inequality of income is due more to innate differences in talent than differences in opportunity, then that makes it harder to argue for reform. I believe thinking along these lines is the major cause for bias today.

So yes, I agree social psychology is quite biased. In the future, we will look back with horror at how we let politics and ideology interfere with science.

[0]http://www.amazon.com/The-Blank-Slate-Modern-Denial/dp/01420...
The problem is, whatever the intentions are I still see people posting and getting away with karma magnets while interesting questions which have real answers are closed on technicalities.
So then it DOES have a daemon? Have you actually tried it? And inotify doesn't work over NFS.
On 2.1 I cannot agree with you, because if you're using return for clarity, you're circumventing the compiler, which is then unable to do proper inference, not to mention it has gotchas, because as I was saying, most people do not know how return works, and besides, if you need return for clarity, you're doing it wrong and I challenge you to show me a piece of code that is clearer with it.

On 2.9/2.14, as somebody that suffered from servers crashing due to enormous load and that had to profile the shit out of everything, I usually find such arguments against persistent data structures to be bullshit, and if you think it matters that much for your problems, you probably picked the wrong language and possibly the wrong platform. And NO, there is no conflict with 3.4.

On destructive updates again, there is a fine line between interesting and boring, plus I don't really have time to write a book. But thanks for the feedback, I'll add more details.

On 4.1, I really hope you're making a difference between concurrency and parallelism, right?

I don't need to back that claim up, just as I don't need to prove that the sky is blue. And as I was telling somebody else, concurrency is not something to take advantage of, but rather something one has to suffer from.

On Java's "broken concurrency model", actually I find Java to be quite sane, because at least it has a memory model that works well cross platform and that is generic enough to support all kinds of abstractions built on top, like a sane Future with C#-like async, or light weight threads (Quasar), or extremely efficient queues (LMAX Disruptor), or Erlang-style Actors (Akka), or reactive streams (Rx), or parallel collections (Scala), or STM that works (Scala-STM) or CSP or Agents or what have you. And because there is no silver bullet, all of these abstractions are useful to have in your toolbox. And surely a platform built for a certain abstraction (eg Erlang) will be better than a library, but also find that to be very limiting.

Again I challenge you to give me an example of a platform that handles concurrency better than Java.

Related to my list, I wasn't the one that posted it BTW, not trying to impose my will on anybody, take from it what you will.
Is Slack actually as popular as it seems to be? I feel like i hear a lot more about HipChat in various forums/reddit/HN than I do about Slack, but i hear a lot more about Slack on blogposts and news articles. Is it actually being used more, or is it just being written about more?
CO2 is a very real threat and we should be doing more about it. That said, the threat is neither direct nor immediate.
Ask HN: Best registrar only and why
I have read blogs, searched HN, and it seems it's time again to find a good registrar. Seems about once a year someone steps in and offers the same as everyone else plus more, and is regarded great for tech support.

I am in need to park 30 or so domains ( now, much more later ) all in various forms of expiration, some just renewed at places like the top 5 ( GoDaddy etc. ) and others are at obscure registrars as I inherited them that way from a client or other source.

I have about 6 that are up for 30 day renewal right now. One is the domains where I have domains@example.com so I want this to be as smooth as possible.

I have managed DNS/bind/named for years, though it has been years since I have. Now it is just troubleshooting with dig and other tools.

What is your favorite registrar only, or colo/shared/hosting/ISP and why?

How are they with SSL certs, changing, and keeping up on keeping TLS secure and doing it all right.

I do need good DNS on their end, though I can't say I have ever had issues with an SOA case, it's always at the DNS level on some remote server somewhere. Though these days I find managing DNS in most registrars browser control panels sufficient. GoDaddy is stupidly convoluted. I am not making mass changes of 1000 domain files at a time. Just one off, add an MX, add DKIM, etc.

If they make setting up any of the above simpler, note that too.

Which ones to stay away from and why.

Thanks for any pointers.

Oh, any that will take current registration time plus what you buy is going to work better for me. I just renewed a large batch with a terrible registrar, and want to move them, but don't want to lose out on those 11 months I just paid for. Some registrars offer "rollover" like that, where you get 11 months plus your year or more you just signed up for.
Well, it's nice you solved the problem, but it would have been more informative to know what had actually happened.
I really can't reply to that, sorry.
Yea, if you remove the dashes from regular UUIDs and base64 encode them they're not much longer than his custom ones.
For the same reason you have a bike lock, or a locker lock--to prevent opportunistic theft. You can prevent people from driveby stealing your stuff, but you're never going to stop a guy with an angle grinder.
Disable SMS for 2-step and SMS for password resets and use a 2-step mobile app.

https://support.google.com/accounts/answer/1066447
Insights from Zuli CEO on Smart Home Product Development
+1

The point went between software, business, life, and biological systems with no segue at all.

And it doesn't ring true for me. If you just collapse on the ground, you can recover and pull yourself up, and heal your wounds. But it's much more advisable to lie down gently on a soft surface.
It probably increases security for the average user, but decreases it for a targeted user.
> I'm completely bewildered by the changing bus/train schedules and don't understand how anyone can juggle all of those routes and times in their head to construct a path to their destination.

Two words: Google Maps.
Or to give the CA a copy of the private key to establish ownership of the onion. This would be more trustworthy IMO since there would be no chance of phishing lookalikes or something akin to the "onion cloner" MITM attack.

EDIT: Or simply redirecting myownfacebook420.onion to facebook.com, because that can VERY easily be done. Just add a HiddenServicePort 80 facebook.com:80 to the torrc.
Why caps?
Pirate Bay Founder Convicted on Hacking Charges, Sentenced to 3.5 Years
Check out NameSilo. Not too many fancy extensions but the free privacy is always nice and prices are reasonable.
Given Netflix's position on browser DRM, and their references in this post to "platform integration" and device keys, it sounds like they're trying to implement HDCP for sockets.

Ugh.
Apart from the usual Manifest Destiny IN SPACE! crap, recently I've been a bit shocked to realize that there might actually be a point in trying to go to remote and harsh places.

The Antarctic being a barren wasteland makes it an attractive breeding ground for penguins precisely because it's so inhospitable to anything alive, penguins included. As long as penguins suck less at living in a barren wasteland than their predators it's a net benefit for them to be there, despite the hardships of the environment.

If we assume there is a group of humans that feel existentially threatened by other humans so much that odds of surviving in an irradiated subterranean Mars colony beat the odds of being exterminated here on Earth, it would be a perfectly rational choice for them to try and move somewhere out of reach.

There are lots of potential scenarios why such groups might come into existence, and not all of them involve outright genocide. For example, a group could form just as a result of concerned citizens wanting to go to some place very, very remote once kids start playing Pokemon with their newfangled RNA synthesizers.
The difference in traction is insane! Slack has 15,000 companies paying them in a few weeks after launch. In the article it says they have $1m/mo revenue - that's incredible for such a young company.

Investors are making a bet that this is indicative that slack are going to take over the entire enterprise communication space.
Audacious Plan to Make Electricity as Easy as WiFi
Here is the most recent version iirc: http://tools.ietf.org/html/draft-grothoff-iesg-special-use-p...
After enabling 2FA, disabling SMS for 2-step and SMS for password resets, and ensuring that you don't have any phone number set as a way to get into you account, what is your plan for continuing to use your account if your phone is stolen?
I wish Singapore was part of the study. I think generally, drug laws do not 'work' (by work I mean, it doesn't stop people from doing drugs and in many ways it probably gets them into situations to commit crimes not related to drugs), but I'm curious how much the study would have been thrown off by Singapore's results.
ARM is using L3 cache as a DMA-like interconnect, on the SoC side of things.
Book Review: Applied Network Security Monitoring
Exactly:

article: there is no direct link between being “tough on drugs” and tackling the problem.

Well, what problem is that?

If we define the problem as "property crime and collateral violence", then those tough-on-drugs laws directly cause
the problem, beyond the shadow of any doubt.

That is the problem that anyone reasonable cares about, not what "immoral" things other people are doing to their bodies.
"when the supporting bureaucracy has lost track with reality"

That's really the key point actually. Things become self perpetuating without anyone even questioning if they are still even necessary.

That said most people don't read contracts (at least most consumers) so in a sense and in certain situations it pays to stuff as many things in there as possible.

What's interesting is how many risky situations you enter into with potential liability where you don't sign a contract.

For example nobody signs a contract to eat a meal at a restaurant. You don't sign away your right to sue if the food is bad or if the meal isn't delivered on time. The car company that sells you a car doesn't require you to sign a contract with them the dealer of course has a sales contract which is different. Car company is big enough to not really have to go that route. They know they don't need a contract to protect against the little things and with a big thing it doesn't matter.

Otoh an electrician just quoted a job to me for under $800. And he sends me this long involved contract (that no doubt he copied from another electrician) which really isn't necessary for this type of job.

I remember when a developer I hired to do work started many years ago. It was a $60k job. Long and involved contract. Ended up signing it (needed the work had no choice). Well we are still doing business 12 years later. But it evolved into a handshake. Nothing in the contract says he has to take my call at 11:00pm on a Saturday night but last weekend he did just that. He and his team finished the repair by Monday morning. I told him to take his wife and family to dinner and we'd pay the bill. Not required but I was really appreciative of the effort. He thanked me and told me it was his job to make sure things were working but he appreciated very much.
So now having eczema qualifies you to be in contempt of court?
Of course your cell phone provider can access your call logs. Probably even fairly low-level workers can get full access under certain conditions.

And of course some workers will abuse that access for personal reasons.

What did you expect? That workers at a phone company wouldn't be able to access your account info? Ideally, it would be compartmentalized, but...
DARPA circuit achieves speeds of 1 trillion cycles per second
I'm intrigued by this, but no demo. Asking for my credit card without a whole lot of explanation about how the service works.
A bit of context without even watching the video:

This dude nearly single-handedly made Braid, and is now working on a really cool 3D title that's well into its development.
The spoofing happens when talking to other devices (not themselves); i.e., there is some layer of the device that knows its true MAC address and the UUID generation code should use that layer.
Christians are a marginalized group?!

Also, he did not attack those groups. He accused them of trying to censor disagreeable opinions, which in fact they often do.

Why did you "[...]" out "patriots, foreign despots"? By removing that, and leaving only groups you considered to be marginalized, you make it look like he is focusing on marginalized groups rather than focusing on groups that try to censor disagreeable opinions.

Furthermore, he explicitly says a couple paragraphs down that conservatives are not "free from sin on this issue", and gives examples of conservative attempts to censor provocative art, further weakening the claim that the article is an attack on marginalized groups.
Backup codes.
> That said, C++/Java-style class-based o.o. is no panacea either and having both things in a single language is just crazy.

Actually, there is just prototypal inheritance. The whole `new` operator thing (as well as ECMAScript 6 classes) is just syntactic sugar over prototypal inheritance.

But yeah, it's crazy that this had to be put in just to attract users (in the 90s, to make it look more like Java; along with method names etc).
Maybe not, but you can always pivot[1]!

http://spectrum.ieee.org/view-from-the-valley/transportation...
Can someone explain the introductory story? Why is it significant that the spaces were finite?
Drug laws aren't supposed to stop people from using drugs, and that hasn't been the goal for a while now.

The goal is to give them a reason to request military-grade toys, and to give them a "reason" to use said military toys despite not being in a war zone. Their thinking (perhaps correctly) is that if they don't use it, they'll lose it.

And this is before we consider lobbying of the for-profit prisons who are literally trying to have innocent people thrown in jail. (0)

(0) http://blogs.wsj.com/law/2011/02/22/judge-found-guilty-in-ca...

Edit: Corrected the link, my mistake.
This is why I always recommend against using SMS-based 2-factor. Without even doing any serious research, it seemed pretty obvious to me from day one that at the very least someone like NSA/FBI could forge your number somehow with or without the carrier's help, but there's also the potential for other attackers to do it, too.

Call forwarding didn't even cross my mind, but it just goes to show how ridiculously broken SMS-based two-factor authentication really is then, and even worse than I thought.

Ideally what I'd want is an NFC ring or a smart band/watch that can use FIDO's U2F or a similar protocol that works through NFC, to do 2-step verification for me.
I still have some invites for Google Domains. I can invite HNers in need; email me at anmonteiro [at] gmail :)
List of 36 Ways to Explode Your Websites Traffic Like a Nucleur Bomb 2014 – 2015
What is the benefit of having immutable variables that are just fake-built at runtime? At compile time, knowing some variables are constant and will not change would give the interpreter/compiler a lot of optimization chances but does this apply the same at runtime as well?

the website says "efficiency" because immutable variables wouldn't need to be deep copied but would the deep copy operations be that frequent in JS?
This is why "2FA" is supposed to actually be two factors. If you're using a phone number for 2FA, then authentication still boils down to the same thing: Something you know.
Not quite the in-depth technical breakdown article I was expecting. I am a big scale nerd, so I love reading the finer details of how a company like Yelp managed to scale and build out its product. I guess you had to be at the talk to get the finer details.

I would love to know more about size of data, languages used, size of teams involved and how things like front-end dependencies are managed. Perhaps a follow-up article?
Phone book? Leaked address book? Leaked account database? Assume your phone number is public knowledge.
This story sounds like a déjàvu: https://news.ycombinator.com/item?id=7141532
Couldn't you generate a UUID and then check the database that it is unique before using it? You could then repeat until you got a unique identifier.
The story behind this is that Jon Blow is tired of making games in C and C++. He wants something better, but not necessarily something that is higher level. This demo goes over an initial prototype of the language. Shown are that he was able to relatively quickly get something up and working. The language operates well, but still has a lot of unknown things about it.

In the demo he shows the basic running of the language. Then he shows it's realistic to write games in the language by running a space invaders like game. He then also shows the power of using the language as the pre-processor (very lisp like) in that he is able to run arbitrary code during the compilation process, such as checking that your printf statements have the proper number of arguments, or having it so you need kill so many space invaders or your compile fails. He also showed that it runs on linux as well as windows.
Yes, because private space flight industry is thriving with success in all the other countries, right...RIGHT?
and they fixed a few Integer overflows
- int size = inCapacity * sizeof(dictEntry);
+ if (inCapacity > (UINT_MAX / sizeof(dictEntry)))
+ return false;

+ unsigned int size = inCapacity * sizeof(dictEntry);
How does the price of a monitor compare to the price of a televisions?
I looked into buying monitors without tuners or speakers in order to save money, but it seems that inch for inch monitors cost at least as much as a regular television.
FWIW this article is about the UK where we don't usually have these issues.
I had an IQ score higher than Marilyn vos Savant's once. I like to think I'm a more creative thinker than most, but I haven't exactly made any world-shaking discoveries ...
More information please, for those of us who aren't Bostonians?
MathNews, UW Math department's student weekly newsletter, had/has a section 'profQuotes' - just about the only part worth reading.. samples from this week:

"Tragically, we will need to prove both cases. Fortunately, I can do one in class and assign the other for homework."

"I’m sure you’re familiar with the proof technique I’ll use here... [writes 'Exercise' on the board]”
I use IPNetMonitorX to do the same:

http://www.sustworks.com/site/prod_ipmx_overview.html

(Got it in a bundle at StackSocial¹ last year for 49.99 USD along with other OS X apps like TechTool Pro 6, Path Finder 6, TextExpander 4, etc.)

――――――

¹ — https://stacksocial.com/
You can have a daemon (tup monitor), but it is not required; in the second case tup will compare last-mod times of files with those from the last run (stored in the .tup dir).