skysight-inc/HackerNews huggingface dataset:
The author is correct to attack Google’s authentication protocol, but the password reset procedure is the gaping security hole. The author is focusing on the distinction between “hard” tokens vs ”soft” tokens from NIST 800-63 Level 4. But in the Grant Blakeman case, the first factor (password) was never compromised. It was the Google password reset procedure that sidestepped all the security of the two factors. All you need is to answer easy trivia questions and to text a code to a phone number in order to take over a gmail account.
The rar files we have at modern.ie are selfextracting. Just follow the instructions and you shouldn't need to install any other tool :)
True, and cool (I hadn't heard of zero-crossing before, thanks!) but an FFT gives you the ability to do interesting things like chord recognition.

I may have to play around with the code here and see if I can get it to pick out multiple notes being played simultaneously, and maybe get it to measure how fast I can do chord changes (like Justin Sandercoe's "1 minute changes" practice method[1]).

[1]: http://justinguitar.com/en/BC-115-1MinuteChanges.php
Loadable kernel modules have long been known to be the source of potential security risks due to the fact that the kernel now has a way to intentionally load code into itself. A project like OpenBSD to me should never have included this feature in the first place, but I hear the mechanism that is being dropped is and old and obsolete version that nobody ever used.
What if mathematics is different in other universes?
Any ideas if this supports Postgres?

Also, I noticed comments about an architecture document here:
https://github.com/Netflix/dynomite

Anyone know where the doc they are referencing is located?
It doesn't say he parked there because he thought it was legal due to the signs. It says he parked there because he "forgot his car." The incorrect signage was a technicality that allowed him to get out of paying the ticket.
Agreed - that's what I'm checking on the majority of the time myself.
http://www.xmos.com/

http://en.wikipedia.org/wiki/XC_(programming_language)

https://www.xmos.com/support/xkits?subcategory=Starter%20Kit...
Do you really mean 'and'?

I have my custom view set to 3 weeks - but the same principle - it shows me from today (or rather, the Monday of the week that today is part of) through to Monday 3 weeks away. It cares not a jot for where I am within the month. Setting the custom view to any other numbers of weeks will doubtless provide the same 'sliding x-week window' view.
I can't tell what the product does. Maybe the extra-simple approach works for dropbox.com, but you'd need to provide more information when the only next step is to ask users for an email address.

After the signup I don't feel comfortable to share files, even test files, with the founders. My inner fear is they'll message me while I just want to test out the product in private. It has the feeling of a shop clerk following my every move when I try a new product.
Looks like a cool service, but mehh...

I would not want to code in PHP in the year 2014.

Are you in the "bingo card creator" space where the product is complete and just needs maintenance or is there multiple technical things that are on the feature-list?
Setting up that thing is a pain... Definitely could use some work regarding file associations (maybe I'm just doing it wrong).

Putting it into a ZIP allows native support on pretty much every platform.
New York's Lawsky Wants to Lower the Bar for Payment Startups
treefrog-thread	223,033

I see a few other languages higher than that.
How A/B Testing Works (for Non-Mathematicians)
DevArcs – On the philosophical ramifications of microservice architectures
It will be interesting to see if in years to come we'll look at Germany's policy as overly cautious and a net loss or extraordinarily prescient.

I'm genuinely on the fence on this one. I'm rather cavalier on privacy issues (at least where they affect my own person) and quite happy with the goodies I receive in return. However I sometimes wonder how I'll feel with the benefit of hindsight.
A desk that is adjustable is cheap... a desk which changes height VERY easily is expensive.
If it's based on Dynamo, then it's using vector clocks.
Is there a 'too late' to get into finance? I might have to change my focus. All this JavaScript and Objective-C can stay a hobby.
Made by another serial inventor, Gregory Sancoff. Must be something about water that attracts inventors (and billionaires).
> There should be a fairly straightforward Javascript workaround for this

There is. Sort of.

It's a javascript bookmarklet I named "FIXEDFIXER" that lives on my bookmark toolbar:

javascript:(function()%20{%20var%20s,e,i,ee=document.getElementsByTagName('*');%20for(i=0;%20e=ee[i];%20i++)%20{%20s=getComputedStyle(e);%20if%20(s%20&&%20s.position%20==%20'fixed')%20e.style.position='static';%20}%20})();

Changes all elements with "position:fixed" into "position:static". Works like a charm.

In my experience this little line of code fixes at least 90% of all my scrolling/coverup/screen estate problems. Sometimes the "position:fixed" element actually disappears, but I've been using this tool for over a year, and I have never had anything disappear that I actually wanted to see, read or use. (funny how that's a lot like the popup-windows on the web of old)
Break the Rules Part 3
The video presentation of this session is available by clicking through the ToC, or Source Materials http://dl.acm.org/citation.cfm?doid=2517349.2522712
True, that sounds like a feature more than a product, plus I would hate to have to rely on third parties.

I want to build a product, something useful.
> The actual purpose of the law is to prevent export of expertise.

You're both right. It can serve dual purposes.

To prevent the export of expertise AND give the government a convenient stick to smack anyone not doing what they want.
Reading through the report from the ASA (that doesn't really "slam" the VAM statistic but rightly points out the flaws inherent to any attempt to use statistics in areas with many confounding factors), it appears as if the VAM is usually derived thusly:

1. Calculate a regression model for a student's expected standardized test scores based off of background variables (like previous scores, socioeconomic status etc). This includes having teacher's as variables.
2. Use the coefficient for the teacher as determined by the model to determine the teacher's "Value Added" metric.

The weaknesses in such an approach are also spelled out in the report: namely, missing background variables, lack of precision, and a lack of time to test for the effectiveness of the statistics themselves.

What's interesting is that the teacher in question was rated as "effective" the year before. The question becomes whether that was based off of her VAM score that year as well as what the standard error was on her regression coefficient. Unfortunately, the article doesn't mention any of that.
I think the problem is that it needs to be effortless to change. Either a complicated counterweight system so the desk can be raised or lowered smoothly with only a little effort, or electronically.

Honestly, electronically is probably easier.
I'm not sure if the problem with Hangouts is UX per se. Can you be more specific so we can have a decent discussion on this?
How will this work with tools like figwheel [1] and austin [2]?

1. https://github.com/bhauman/lein-figwheel

2. https://github.com/cemerick/austin
From the 4 random man page.

"A read from the /dev/urandom device will not block waiting for more entropy."
Why would you use multiple datastores? Isn't it much more difficult to atomically store data this way? Assume a transaction succeeds in store 1, and fails in store 2, you'd need to roll back the transaction in store 1 after it has committed (!)
I think it is, yes. I don't really follow driver updates all that much, but Nvidia's GeForce Experience application routinely tells me about new downloads (most recently a week or two ago). And it's not a proprietary Apple fork, either: I downloaded GeForce Experience straight from Nvidia as soon as I installed BootCamp and haven't had any problems with it.
Love the story! Interestingly, the fragment identifier has .hackernews in it... at first I thought that the poster was doing their analytics team a nice favor by adding it in, but turns out spectruman is either a bot or a media account for IEEE Spectrum (look at his post history). I know Reddit has rather strict policies for this type of account, not sure what HN's policies are. Either way, mods, please don't remove this story, or I'll just repost it as an interested third party and the comments will be lost :(
HN loves Neural Nets & Deep Learning - it's all i ever see in my RSS feed (with regard to ML methods)
This is a great piece of work - thanks @karpathy.
And? The tickets were therefore unjustified.

Live by the law, die by the law.
Reminds me of the Bose active suspension system for automobiles:

http://www.bose.com/controller?url=/automotive/bose_suspensi...

Video: https://www.youtube.com/watch?v=q8sVDenpPOE

IIRC, the major difficulty with commercialization was gov't regulations?
If one part of this clock is accurate to 10^-16 but noise/error contributed by some other aspect of it is larger than that, then it is misleading to claim these clocks have an accuracy of 10^-16.

This is the same type of stuff they are dealing with in the gravitational wave experiments like LIGO and VIRGO. They have amazing sensitivity but it is still lost in the noise. They don't claim to be able to make measurements to accuracy which is lower than the noise levels. And I don't see why these clock people should either.
Hi there.
I'm sorry it caused you worry to read what I had written.
I was speaking largely in general terms - as I am sure you would be aware discussing medical situations, despite being medically trained, over the internet is not the best way to do things and I would hesitate to tell anyone that it is ok to sit at home and do nothing if they experience chest pain they are concerned about, it should be investigated at least once throughly.

It certainly does sound that if you are known to a cardiologist. have previously had negative stress tests and have had recurrent episodes of the same type of pain with negative ECG's then you have been worked up appropriately to exclude a cardiac cause.
Your primary care doctor knows you much better than I ever can over the internet so I defer to their more expert opinion and interpretation of your recurrent presentations. Take solace in the fact that previous investigations have shown the pain to be non-cardiac in origin.
More precisely, the way it uses COM.
I'm not an Ember dev (I generally can't justify a clean slate project) but I do have opinions on the web development landscape:

The primary source of incidental complexity in frontend development is synchronizing state. The two main places that's happened is synchronizing state between the model and the server and between the DOM and the model. You can see this in the whole history of web development: cookies, sessions, continuations (/wave Seaside), the shift client side (not having to sync viewmodel state, just model state), the MVC shift (restricts where you state interacts), componentization (ditto).

I believe the vDOM/diffing approach is the end of the line in the model->DOM chain. The only place I've found where it doesn't work cleanly is when the output has to be looped back into the model (Rich Text Editor and DnD layout builder) and even that is workable. Otherwise the abstraction has not leaked and reasoning about component behavior has remained local to the component (it's possible to screw this up but that's not the fault of the approach). Once the view layer is written, data goes in, DOM is in the correct state.

Server synchronization remains a problem. The current approaches like Meteor/Derby/Firebase aren't unreasonable but they're rooted in the same place-oriented temporal logic as two way data binding. I don't know what the solution is here. The most promising lead I've run across is Convergent/Commutative Replicated Data Types (CRDTs) from the distributed systems researchers.

In the shorter term, I expect CSP (go channels) to gain acceptance as a replacement for callbacks/promises. It's reasonable to implement the model in javascript on top of generators and is roughly as powerful as functional reactive (FRP) approaches but more accessible to non-functional programmers. There are other efforts like the js streams effort so this might not be the answer but I do expect the community to stumble into a stronger async model than promise chaining.

I'm not particularly bullish on Web Components. Having scoped CSS will be very nice but the rest is focused on problems I don't see as important. I believe the core problem with widgets on the web is customization. There's a lot of web components material on encapsulation but I haven't seen a good explanation of how I can tweak the classList on a node in the shadow DOM for a use case the author didn't anticipate. I've used widget systems (netWindows, Dojo, Ext, YUI, Sproutcore) and have re-implemented many components for this and similarly minor reasons. Encapsulation by itself doesn't do a whole lot for this, I've implemented drop down combo boxes a dozen times. The x-tags/polymer interoperation demos are neat and I think that's the goal but the parochial nature of js libs means it's not something I'd really like to put into one of my projects. Smart people work on this effort so I feel like I'm missing something or not the target audience.
If you can't synchronize the clock with any other clock in the world, the increased precision of this kind of clock gets a bit meaningless (or at least has only a very local usefulness).
It depends on the location of the observer. (coming towards you = blue, moving away from you = red)
I may be wrong but this sounds like a confusion of accuracy vs. precision (http://en.wikipedia.org/wiki/Accuracy_and_precision)

edit: By which I mean that this clock could be precise to 10^-16 but be off by 10^-14 due to a mis-calibration.
You seem to have your concepts mixed.

asm.js is a compiler that produces portable standard JavaScript output, like CoffeeScript or Elm or ClojureScript, except that its source language is C or C++. The output works on any browser supporting JavaScript, including Chrome and IE. It works very well on Chrome and Mozilla (haven't tried IE recently - old IEs would be slow due to missing TypedArrays and friends, but it would still work).

Yes, the created JavaScript is annotated in a way that Mozilla uses to improve speed (and other browsers can, though they do not yet as far as I know) - but those annotations are still perfectly standard JavaScript that even the oldest IE is not confused by.

The main use that I'm familiar with for asm.js is to make use of an existing C/C++ codebase. See e.g. all of https://github.com/kripken/emscripten/wiki/Porting-Examples-... and especially the utilities section. Rewriting Poppler, GnuPlot, eSpeak or SQLite in JavaScript is no small undertaking - and asm.js makes this rewrite unneeded.

> Unless the barriers to entry for compiling to asm.js can be very significantly reduced, it will become a Mozilla-only ecosystem.

While using the asm.js toolchain may not be trivial (or it may be - I last tried it a long, long time ago), it is only the outputs that are meaningful for end users, and those outputs are already compatible with every other browser. The assertion about a Mozilla only ecosystem makes absolutely no sense.

> and I think the effort would be better spent on standardizing a spec for a true VM instead of trying to back-compat-hack one into javascript.

Those who ignore history are doomed to repeat it. This idea has been aired in some way or another since the early 60s. And yet, every single implementation has failed to deliver on the goals of a "one true VM" (yes, including the CLR, JVM, UCSD p-Code, and tens of other that did gain some traction). The best "true VM" we have today is, surprisingly, x86 and AMD64 bytecode. It has a hardware implementation, which makes it wicked fast compared to all the others - and it is also significantly lower level than any "true VM" proposed to date.

Luckily, Mozilla is learning from history and not ignoring it.
VAMs are an issue for the reasons mentioned in the article, but just because a teacher reliably produces the highest performing students does not mean s/he is a good teacher.

There was a teacher who was the only teacher of highest track Algebra II class at a local HS who had such a terrible reputation among the students that some would drop down one track in math to avoid having her. Numerous students (and their parents) complained to the administration and the official reply was: "Our top math students all came out of her class" which was a rather specious argument since all of the top math students also went into her class.

Unofficially she was close to retirement age, had seniority in the department, and nobody wanted to poke the beehive of forcefully reassigning her classes.
Any idea how log it takes to assemble it? Few years ago my work bought one for a star programmers. And i remember 2 people taking half a day to assemble it. It also had motors for up/down movement...

i would love to get one at work and home.
This is a very timid conclusion. If the author had followed his reasoning to to the bitter end, he could have proclaimed 'each method should contain only one operator' and left no doubt as to the power of his insight.
Strange... you should definitely see it if you are using jemalloc now that it's clear it's about mass-COW.
I've got a number of .ical calendars added to the web interface, and all of them both appear on my phone, and get updated without me going to the web interface. I'm not sure if my device retrieves them, or whether google's servers do it for me (probably the latter). It would be handy to have a full calendar app though.
Given their webpage says explicitly that it is not an attorney client relationship I doubt they will represent you in court.

What could happen is they give you all the information you need to show up to your court date and listen to their channels for how it went.
Got me looking at impressive boats. This team broke the record at 65.45kts over 500m. Ride looks pretty rough.

http://www.sailrocket.com/node/674
They Will Not Come – Taking Kifu Offline
Automatically 2-way binding everything is a serious mistake since most elements don't need it and it's a performance hit. Scope and ControllerAs are in conflict (particularly with ng-if/ng-repeat). Dependency injection is needless, since Javascript module requires (via Browerify or Webpack) handle this much better and sensibly. Extremely hard to debug since stacktraces are useless. Module factories, services, and values are unnecessary, since Javascript already has established design patterns for these concepts.

If you haven't tried React, please give it shot. Particularly if you are about to make a decision on what frontend framework you will use, or if you are using AngularJS already and recognize that it's approach leads you to ugly workarounds.

I can't emphasize enough that AngularJS is bunk.
>Number five is the rule that’s being broken by an increasing percentage of the web without any custom scrolling at all: Every site with a sticky top bar breaks spacebar / pgdn scrolling by covering up the top few lines of text after a full-page scroll, requiring the user to back up a few lines to see what was hidden.

I just find out that medium.com does it the right way!
It doesn't support Postgres yet but that is on the (longer term) roadmap.

However, since it is open source, contributions are welcome! :)
How Southwest Airlines Settled a Legal Dispute with Arm Wrestling
Estimating the Welfare Cost of Somali Piracy (2011)
College major salary premiums
Subu Must Die: How a nation of junkies went cold turkey (2013)
Is that...bad?
Except AOSP Email was updated in Lollipop, as was Messenger.
Well, yes. Unfortunately. I mean it's definitely "wrong" that the government sucks. As a fellow libertarian-sympathizer, I totally understand. But instead of beating our heads against the wall, we probably have to just suck it up on certain issues. This is definitely one of them.
Theranos - Palo Alto

Visit a lab for a Doctor’s appointment recently? Two vials of blood is a lot isn't it? Theranos is looking to completely redefine healthcare by solving speed and accuracy issues of current lab testing by combining SW engineering and life sciences using 1/1000 less blood than what is typically drawn today; our process have results in Doctors’ hands in as little as 2 hours allowing them to provide significantly more accurate treatments in a timely manner.

http://www.healthcaredive.com/news/theranos-the-new-lab-diag...

An advanced stage startup, Theranos primary stack is .Net - We are looking for engineers who want to make a positive impact in healthcare. Also looking for embedded, Senior iOS & Android developers.

VISA & Relo assistance (for those already in the US) - Sorry No remote – No International Relocation.

What’s it like working @ Theranos? http://vimeo.com/107759726

For more about each position: http://www.theranos.com/careers/software-development

email michaelw at theranos dot com
I did. Now I'm in Manhattan where it's cheaper, funnily enough.
That's only for measuring the time since 0 BC. If you're trying to measure the duration of a very precise experiment to a very precise degree, this kind of clock can be very useful.
I meet quite a few people talking about moving their tech infrastructure away from US controlled cloud services. I may live in a bubble, but it would be interesting to see some data on intentions in EU companies about this.
I think if you're a dinosaur in any space being devoured from the ankles by smallfry startups, the least you can do is build up some skunkworks projects to protect yourself somehow.

The dinosaurs more often than not try to protect their declining fortunes rather than cannibalise their sales, but often they could be doing both and doing it more effectively.

In this case there was a bit more going on, obviously.
I've been meaning to ask, what's the correct way to ensure urandom has been seeded before you use it?

In fact, there seem to be some strange ideas about urandom floating around on the internet. For example, from http://stackoverflow.com/questions/3690273/did-i-understand-...

The entropy pool and blocking read of /dev/random is used as a safe-guard to ensure the impossibility of predicting the random number; if, for example, an attacker exhausted the entropy pool of a system, it is probable, though highly unlikely with today's technology, that he can predict the output of /dev/urandom which hasn't been reseeded for a long time (though doing that would also require the attacker to exhaust the system's ability to collect more entropies, which is also astronomically improbably).

This implies that urandom needs to be "reseeded" periodically in order to maintain its security.

My understanding is that if urandom has been seeded with 256 bits of entropy, then it's impossible for any attacker to ever predict urandom in any circumstance. If you don't know the seed, then predicting urandom is as impossible as decrypting AES-256 ciphertext that was encrypted with a random 256-bit key. Which is to say, computationally infeasible.

Is that correct? If so, what sort of C code or startup shell script would you recommend running in order to ensure 256 bits of entropy have been collected by the kernel and used as a seed for urandom?
Would love to see a little behind the scenes for this, maybe a write up / blog post. Pretty neat little experiment.