skysight-inc/HackerNews huggingface dataset:
Worse than stupid web vulnerabilities of the sort you mention, but many startups don't even practice a modicum of best practices.

My coworkers recently tried a new New York-based food delivery startup and found that their auth wasn't even HTTPS. Forget XSS or SQLI, this is basically propping your front door wide open with a sign "please take whatever you want".

Worst part is when we emailed them they tried defending the use of HTTP for auth. Took a bit of convincing to get them to take us seriously.

There are a lot of startups out there whose security practices aren't just deficient, they're straight up amateur hour.
I am really excited about the possibilities here. If they can pull this off (big if) you'd basically end up something like the App Store or Google Play, but it's hardware modules. Drools
Coursera Open Sources Custom iOS Scrubber with Tutorial
> It's really unfortunate though there there are people who can't resist the urge to shame others and enlighten the world with their sharp & intelligent wit

Amusingly this has now happened in another thread in these comments.

The meaning of a post has been overshadowed by a conversation on how the author used word A when they really should have used word B, and then they were berated for trying to explain why they thought word A was acceptable in the context.
We're moving away from this paradigm though, the traditional ATX desktop is a dying breed and the mindshare has already moved to Intel Next Unit of Computing, RPi, System on a Chip design. For general computing (not hobbiests) we already have enough compute power. See the MacPro and the Mac Mini, most of the parts are not upgradable. I really don't think smartphones will be an exception.
Key words from the video: could, imagine, future, possibilities

Words lacking from the video: can, will, does, now, reality
Young Adults Are Living with Their Parents, but Not as Much as or Why You Think
Cool! Do you know of any app I can use to read my picture and name from my EU ID card?
A total is the sum of squat, bench press, and deadlift.

That 1102 bench is with a multiply bench shirt.
I'm coming to this massive comment party late, but I wanted to drop my thoughts about this and explain why I'm personally very excited by OneGet.

I'm a very experienced Windows Server Admin (15 years). I'm also a fairly experienced Linux Server Admin (7 years, on and off).

I'm currently an SCCM guru for a ~4000 user organisation.

I'm sure that if OneGet is supported by MS to the level which the developer explained in the reddit thread it'll be a boon to power users managing their own systems and to desktop support people.

But I can imagine that it'll be the SCCM teams who can leverage the most out of it.

The thought of being able to deploy and manage software across desktops and servers in a similar way to apt or yum makes me feel something close to utter joy.

I've had to build some very complex task sequences to install software on corporate machines. The worst example I can give is MS's own Dynamics CRM application. I was seriously proud of the batch files, registry inserts, dll hell avoidance, dependency solving, mother of all automated install processes to get Dynamics installed and hooked into Outlook in a magical way that the end user had no clue the complexity of.

It was only after slugging through developing all of the above that I found the incredible PowerShell App Deployment Toolkit [1], which people smarter than me had developed to basically handle everything I'd just slogged through.

From what I see OneGet has the potential of allowing us to easily push installs and updates via SCCM with out having to rely on 3rd party tools, batch files, msi rebuilding and general hackery.

Even if it doesn't gain wide support from software vendors, just enabling me to rip everything out of an msi and repackage it into a private OneGet repo sounds superior to having to rely on complex SCCM task sequences.

I'll be watching this closely.

[1] https://psappdeploytoolkit.codeplex.com/
I simply love those video demos. Great presentation! Gives me high hopes for the quality of sound files. Purchased immediately.
Facebook's 3, 5, and 10 years plans
Granting one understands, generally, how these vulnerabilities work (read up on that site) - what would then be a good next step? Oftentimes these small companies are focused on getting the data-flow to work and have not coded in all the edge cases. What are reasonable (easy would be nice too) steps one can take to help mitigate the most vulnerable edge cases? Or is it something that should just immediately be hired out just before you want to go live?
Yup. I think part of the problem is that Americans group together "Universities", "Colleges" and "schools" as "schools". In the rest of the world you leave "school" after High School and make a conscious decision to go to a college or to university. It's pretty clear that they provide different syllabi.
>virus/firewall updates

You're still using third-party software for that? There's part of your problem! Getting rid of those would also kill of the "suspicious behavior" popups.
In theory, I'm right in your target market. I've been considering a good way to keep my handful of users up to date with small changes that aren't big enough to be immediately visible.

But I'm just not feeling it.

In the FAQ, you try to distance yourself from the way that blog posts are used. But, and this is big, blog posts can be used exactly like it seems VisionHistory is designed to be used. I could post nothing but a bullet list on a blog. Just because most people don't doesn't remove that possibility.

I was intrigued enough, given my current desire to have/make a solution to this, to check out the pricing page. So it's not that I was completely uninterested. But I wasn't interested enough to pay the prices listed and I don't know what you could add that would change that. It just seems to solve too small of a problem.
That's also why research, prototyping and product development should often be done in ways where failure is a lot cheaper and your optimum failure rate can be much higher, accelerating progress hugely.

For example at a smaller pilot scale or in test benches.

Yet, if your test bench is very complicated, slow, costly and introduces errors of its own, it might not be wise. Also some "flying" test configurations can be a dead end.

So in the big "Battlestar galactica" NASA missions with lots of new technology, the cost of failure is very high. That's why they analyze a lot and test stuff in test benches. But those can be dead ends. It makes everything even more costly, making failure even more expensive, requiring more tests. Schedules slip while you have zero science return to show... It's a vicious circle.

It might make more sense to just for example launch many smaller probes, each one somewhat better than the previous one in some degrees. Some might crash, but if your audience understands that, it's not a political disaster. You're going to fly the next one again in two years. This way you also don't have to wait 20 years for your technology development to pay off.

So SpaceX launched Falcon 1 quite many times, and learned a lot about technology as well as matured as an organization. They crashed quite many times as well. But those were not nearly as expensive as Falcon 9 crashes were at this point.

That's also why they were flying different versions of Grasshopper and now Falcon 9 R. Retire risk. Allow crashes - when you can afford them. This will reduce crashes later when you can not allow them.

So it is a slightly complex issue but nothing very out of the ordinary. Usually in the real world things settle into a good compromise between conflicting goals.
Show HN: GarageServer.IO – lightweight, HTML multiplayer game server for Node.js
How Apple Pay and Google Wallet work
A "great product" from the perspective of a merchant who wants to not pay credit card processing fees. Not a great product from the other side of the transaction.
actually it only does two, lxc and libcontainer (aka native)
https://github.com/docker/docker/blob/master/daemon/execdriv...
Wouldn't that kind of long-term socializing increase a chance of encounters and affairs between different (or even same sexes) and affect work relationships? Not every person has a motto not to sleep with work colleagues ;)
Any idea for what purpose was this video originally made?
Why even waste your time with them if they won't listen?
Don't ever apply for a job. Never submit a resume.

Do get out and network every week. Strategically look to connect with senior executives in your space who you know how to help. Use Linkedin to find ideal profiles. If the conversation turns towards making a move. Be sure to say, you may be open to opportunity. But any discussion must be privileged and confidential. *Incidentally, find out the 2 start-ups that blabbed about your colleagues. Quietly black-list them.
Apple won't ever admit it, but I'm sure they're loving this turn of events. Having potential competitor stumble before it's even launched is great publicity.
Pretty schmick & the user search interface is insane.
Often installing your own os or rooting your phone requires utilizing a security hole discovered by someone else. This arguably violates the DRM anti-circumvention bits of the DMCA.
It taught me a dangerous way to think, to view the world as efficient, logical, rational, infallible.
I think you've missed something here, the response rate does increase, it's the % of offers that fall into that category that is represented by the bell curve.
That's a good idea. The Stumbler app shows the coverage map (as blue clouds) on your mobile device, so you can see which individual streets are yet to be stumbled. Right now, our database is small and young enough that rescanning old data is not a high priority.
To expand on it, its also a security thing. Having my phone with a network of personal contacts and my computer with more work related data means a separate of attack surface.

At this point, if you have anything worth securing, its probably a good bet that your device will get compromised in the next 5 years. Compartmentalized devices helps with that significantly, since it means only partial compromises.
Provide the range for the corresponding "expectations and criteria for success."

The person earning the high end of that scale is almost certainly not working in the same role as the person earning the low end. Their jobs are different, even if the HR-mandated job title is the same. It shouldn't be difficult for the person responsible for supervising and hiring for the roles to write up job descriptions that accurately reflect that difference, and provide a corresponding gradient of ranges that is appropriate, but doesn't include such a wide salary range.

If it's not possible to do this, I'd submit to you it's very likely that: the person earning the low end of the range is getting shafted, the person earning the high end is (relatively) over-compensated, or your organization has/had some serious lapses in distributing tasks and organizing your talent around the jobs to be accomplished for the company's mission. All of these things are negative indicators, in my opinion, so why shouldn't a prospective candidate view them as such when presented with that information?
Show HN: Cider — Hassle-free bootstrapping using Homebrew
It sure beats nothing which is what a lot of other States provide over here.
"Move fast and break things" then just look for an exit and it will be someone else's problem.
Some ATMs require you to take your card out before entering your PIN. Or are they using the magnetic strip?
> The site is very broken if you don't have Javascript enabled.

I agree with all of your other concerns, but it is not the responsibility of the web designer to accommodate people who selectively disable parts of their website. If you turn off CSS, or the color blue, your experience will degrade, but that's 100% your fault. The same is true with javascript.

It runs quite well on my 1.8ghz Atom netbook and my Nexus 5. The JS they're using doesn't seem that expensive.
You don't get why they're not using the system you just called "retarded"? You'll forgive me if I'm a bit confused.
Could be! I recall it being unofficially "Duke Nukem Forever" as early as 2010: http://stackoverflow.com/q/3367226/240438
>only true for _PC_ desktops

What other kind of desktop is there? Chromebooks/laptops fall under the same category, but that still isn't nearly enough to justify your claim.
This requirement has kept me away from taking powershell seriously. English is a horrible language for telling computers what to do.
How do you use "proven NFC payment card systems" without electricity? This isn't a sarcastic question, I'm genuinely curious.
"Shortcomings of the STL format in terms of processing time and object dimensional precision are a barrier for the production of complex, high-precision parts ... this format only allows geometric representation, so it does not allow voxel-by-voxel information to be carried from the CAD software to the printer. To realize the full potential of 3D printing, the roadmaps of 3D printers and 3D CAD software must be aligned, and the roadmaps must be accompanied by a change to a more information-rich file format."

To me, this right here is the heart of the white paper. If they want their machine to stand apart from polyjet (Objet) technology by printing with per-voxel control of multiple materials (very similar to Objet's digital materials [0]), then they're going to have to create a new workflow for engineers to design with (which was not detailed in the whitepaper other than this mentioning of a new kind of file format needed to handle the design information). Particularly, is the design workflow going to allow for finite element analysis (FEA) of both geometry and material? People are already creating CAD software that will allow for user-friendly FEA of geometry [1], but I'm not sure if anyone is working on FEA of both geometry and material. If HP can develop that solution, that right there would be a legitimate breakthrough.

[0]: http://www.stratasys.com/materials/polyjet/digital-materials
[1]: https://www.youtube.com/watch?v=MU3W-RrJDT4#t=327
The shackles that digital purchases bind you with make me resist buying digital whenever possible. Subscription services, like Netflix, are a whole different, and interesting, beast.
Well, actual (paper) money doesn't endure the elements that much either...
>I blame hiring managers more on this one.

I used to work for a team lead who took a lot of time prepping recruiters on what he wanted. He took time to write up a good job description which stated that what kind of past experience would be a good match and which ones were _not_ a good match. Then applicants were asked to take an online 30min C++ test which tested some very basic skills. This weeded out about 95%.

Almost everyone was given a contract to hire offer. If you are good enough, you "rake it in" during the 3-6 months or so to make up for the "risk" you are taking as a contractor.
It's an enterprise product, e.g. the printer will be expensive and the service will be accessible to consumers via service providers.

There's a general consensus that the hobbyist market is well served but there's room for service providers of high quality 3D printed parts.
Startups optimize for fast growth and monetization with limited resources. Time spent securing a site is considered time wasted not improving SEO or user experience. It's already well known that people will sign up for an insecure site because they really don't care until something happens, and apologies after you've gotten traction (and their money and/or data) are less risky than potentially going live later than sooner.

In other words, not only do many startups not care, they would consider application security to be actively harmful.

This is of course assuming they know. Vulnerabilities may exist in libraries, packages and frameworks which are not known about, or in the case of PHP, old and unsafe practices are easier to copy and paste and tend to proliferate on tutorial and Q/A sites.
They're not just a payments platform that contains 16 digit CC#s, they also contain SSIDs, Drivers Licenses, Checking/Routing #s and the PID that goes along with that. My god, if you had that data, you could create all the 16 digits credit cards you would want, by forging those people's IDs. You could even create bank accounts in their name, and probably get a Passport.

Not just a small target...
I suspect it's the same as well. I think CurrentC wanted to stop Apple Pay and the rest were just collateral damage.

Which is stupid. Apple Pay is the most available way to pay for something that is as secure as chip & pin in the USA.
This is exactly what I'm talking about. The attitude is that overlapped IO is "better" and screw you if you don't want to redesign your existing software to use it.

First, here's a real example where it isn't better. You have some app which holds a thousand some sockets and receives packets infrequently. With epoll you need one buffer when the odd packet arrives regardless of which socket is ready. With overlapped IO the amount of buffer memory you need is more by a factor of a thousand because each idle socket still requires a buffer to be allocated to it.

But that's not really the point. Having overlapped IO available is fine -- it is better for some applications. The problem is not having epoll, not only because epoll is sometimes better, but because it makes portability unnecessarily difficult. Because in most cases the performance difference between the two is irrelevant and the important criteria is how much work I'm going to have to do to make them both behave the same way on each platform.
Concerning France:

> Public university programs charge only a small tuition fee of about 200 dollars for most programs.

Public universities are indeed very cheap and they tend to offer more and more English programs to attract foreign students. However, they're usually not prestigious as there is very little selection to get in. The brightest students usually follow a different path.

> Other, more elite institutions have adopted a model that requires students to pay fees that are based on the income of their parents.

I think they refer to business schools which are mainly private and more expensive. However, the best scientific schools are public (and pretty much free) but there are very specific admission conditions, and teaching is mostly done in French.
I don't see what's absurd about that - establishing probable cause and then doing a search with a warrant is exactly how things are supposed to work. I think it only seems weird to you because you were the least knowledgeable person about what was going on - the Feds knew there was a stolen goods ring in operation, the thieves knew you were a potential dupe who just wanted an easy buck, whereas you were young and inexperienced enough not to find anything odd about someone asking for your help in selling (what was then) a very high-tech item with a price to match.
They're probably going to just let the land lie fallow.
Exactly right, we value existing tools - that's what makes DO so strong. :)
Osquery: Expose the operating system as a relational database
I suspect the point was that this was this program comes from established companies that have no place making the same mistakes that startups make, or for the same reasons.
http://i.imgur.com/TWrzM5l.gif

(yeah, I did it)
That's really gorgeous. Great work!
I found one of the article comments particularly funny and noteworthy:

"Question: How do you convince investors that you can teach critical thinking skills?
Answer: Screen for students that already have those skills."

Put the %2.8 acceptance rate in an interesting light.

Anyways I think this is interesting and valuable if for any reason that it's a new, and different idea and some lessons of value may stem from it.

What I liked the most was the 2 year "Go do something novel" task. I think the most valuable form of education comes from attempting to do something non-trivial and more focus on that is interesting.
>The Aha moment for me was watching the beans spill on the touchpad and getting immediately digitized and put into a presentation.

Which is probably just a demo thing, and nothing that users can or will do in real life.
I think OWASP does a good job explaining this stuff if you know how to build a web-app, you should be able to understand the vulns (they give PoC code and examples).

OWASP could be doing a lot more but their PoC and descriptions are pretty good.

Your next step is to think about how you will be preventing them. An example, If you are writing a PHP site without a framework, how will you generate, validate, and store CSRF tokens? How will you filter output? How will you architect your web-app to prevent SQLi?

Security consulting is ridiculously expensive and I've seen companies pay a lot to get told very little. If you want to run security concerns by me, I am free to contact.
I completely agree with this. QR codes are cumbersome and I refuse to allow any app using with QRCs at its core to touch any of my money.
Good job on these!
I've always thought verb-noun made more sense (since functionality in powershell isn't bundled/accessed as a complete program it has that flexibility).

* Install-Package firefox

would be hugely preferable, though. Smart defaults are good things!
Yeah, I guess it's not every time anymore, to the extent that developers tend to just package copies of all their app's dependencies with the installer, rather than try to update a shared DLL that may be locked by another program.
'Wasting Time on the Internet' Is Now an Actual College Class
In-depth look at CurrentC and the personal data they want to collect – iMore
How certain do you need to be that someone's life is in danger? This is why we have a judicial process to get warrants.
Project Ara is a cool concept but very vaporware-y. I don't think it will ever come to market as a general release consumer product.

I have three distinct reasons for this belief:

- Current gen' cellphones are extremely dense internally. There is no empty space, a Project Ara phone needs room for connectors, housing, and similar. Where does this space come from? The battery?

- Either the components will be tightly coupled in which case you'll lose the primarily benefit (interchangeable components) or loosely coupled in which case you'll lose performance (as data is transitioned in and out of generic interfaces).

- The connectors can never be "good enough." With the phone heating and cooling (environmentally or from internal sources) and the phone getting knocked around/bent/etc you'll see components disconnect from one another and the thing crash, a lot.

The Project Ara project might generate some cool concepts which they can go forward with, a lot of cool ideas come from other failed ideas. But as a whole concept where you can slide in and out components and it somehow doesn't increase the size, weight, or decrease reliability or battery life just seems like a pipe dream (baring any massive improvement in battery technology).

I genuinely hope they succeed and I'd buy a Project Ara phone if they can engineer something remotely palatable, however the engineering challenges on this one just seem too high to overcome.

PS - I didn't even touch on the software issues and some of the chick-egg problems relating to this (e.g. are they going to have a pre-Android OS run who's only job is to reconfigure Android for the hardware changes?).

PPS - This negativity has nothing to do with the recent demo crashes. That happens during development, it is normal. I am more concerned about the technological challenges they face and if they're over-come-able at all.
You know what works every time, is accepted everywhere, has no processing fees, and won't leak your personal data?

Cash.