skysight-inc/HackerNews huggingface dataset:
Are you talking about Randy Thornhill? In that case, who is the other Thornhill?

I'd like to know because if you don't like them then they are probably worth reading.
Maybe they simply killed all the inhabitants in a more organized way. They were, after all, highly organized.

My reading of James C. Scott's work on Southeast Asia leads me to suspect a highly-organized state that controlled irrigable valley lands would wage war in order not to kill, but rather to enslave/enserf. (The various kingdoms of what would later become Thailand and Burma he writes about were after the Harrapan, but seem to have been similarly situated.) TFA actually mentions "So the Harappans appear to have been a very diverse lot", which may or may not be credible but is certainly consistent with the regular conscription of agricultural labor from afar. The idea is that in such a situation labor is the limiting resource, not land, water, or military might. The "nobility" always want to have more people at work in the fields than they can really control. Regular promotion of civic-minded peasants to military or bureaucratic service helps to ensure not just that their families will remain peaceable but that more families will be available to work soon.

Of course Scott documents this process more comprehensively for the societies he studies than would be possible for this much more ancient society.
The Economist had a pretty scathing tear-down of indicies in the issue week before last. One article specifically criticises the Global Slavery Index, another is more satirical, but still well worth a read:

http://www.economist.com/news/international/21631039-interna...

http://www.economist.com/news/leaders/21631025-learn-ruses-i...
Flow seems to be close to a true application of type theory and is written in OCaml. Well done Facebook.
They haven't rehosted the many images though, still linked to the server which has fell over.
How to Build a GitHub Webhook with Node.js
To what extent are you "entitled" to "investigate" into the personal lives of journalists and public critics?

If your goal is not to intimidate, what purpose does it serve and accomplish? Freedom of the press is important and is part of the Constitution. Journalists can investigate a business even if you think they shouldn't.

Looking into the financial ties of journalism is game. But the industry and business of journalism is not the same as someone's personal life, their sexual preferences, children, family, etc.
Or maybe it suggests that the technology is only useful if it can be used for the illegal gathering of evidence.
451 Research Launches Cloud Price Index
The negative to this is similar to the negative of Flattr, you're giving a prominent position to a button/brand other than your own for less than the value of that space. On Adam Corolla's site, he's got it in the top banner, a very prominent position. It's only gotten him $3.30* in exchange, a very cheap ad buy.

It will be interesting to see how these perform after a week and a month vs just placing a small ad there. Especially after the $2,000 they gave away to spur usage is used up. I'd wager these will only bring in a small fraction of what an ad would.

One positive over Flattr, though, is at least you can see how much that ad position is paying out as a visitor. 1 Flattr doesn't have a direct connection to dollars.

* - I'd originally forgotten the default tip is 10 cents, not $1. Updated with the 1/10th value appropriately.
Google is a CA, and they sign their own certs as "Google Internet Authority G2" under SHA fingerprint BB DC E1 3E 9D 53 7A 52 29 91 5C B1 23 C7 AA B0 A8 55 E7 98.
One suspects that there are plenty of more primary sources for this matter. (Also the WSJ is a Rupert Murdoch mouthpiece, and bypassing its paywall is a mitzvah.)
>A browser extension could automate this.

Unfortunately, it couldn't on Chrome, because you can't even access a page's certificate from an extension in Chrome:

http://stackoverflow.com/questions/18689724/get-fingerprint-...

And Firefox's certificate API is not much better, only passive access without ability to block connections if you detect an unwanted cert.
If you are interested in learning more about Flow check out the docs [1] and github repo [2].

[1] - http://flowtype.org/

[2] - https://github.com/facebook/flow
I might try this app out. I recently turned my Facebook off due to privacy concerns. However I found I was missing out on really important stuff like family reunions, engagements, new baby pictures.

I currently browse facebook only in a private tab, mostly as a response to frictionless sharing.

If I could only consume the part of facebook that I need to stay in touch with family that would be great.
I don't understand how we allow technical recruiters to be so horrible at their jobs. In what other industry is it allowed to know literally nothing about what you're doing, and never require you to learn anything, yet get paid so well? Even at McDonalds you have to learn how to work the equipment, as easy as it is. I've had recruiters asking me for more years of experience in .NET than it's been released. And I love the question combo of "How many years of experience do you have in C#? Okay, and how many years in .NET?"
>> "...same level of secrecy..."

Well, no. As pointed out elsewhere in this thread, if Whisper Systems doesn't own the whole app, then the Whatsapp code might include code (that they "forget" to show Moxie) that phones home to the Zuckerberg mansion/windowless black buildings in Virgina.
Which part of Nokia? Networks, HERE or Technologies?
It isn't clear from that page, but this is actually the latest version of IBM Domino, i.e. the server for Lotus Notes.

IBM still have a large number of corporate customers on Notes/Domino and they've been talking for a while about how to integrate email with other "social" apps for file sharing etc.

This is obviously server-based and so means e-mail without the Notes client, but I believe that it's still built on a Domino server underneath.
Unless they use referral page to identify aggregators (Reddit, Digg, HN, etc.) as a specific channel.

For a news website you would hope they do, otherwise their marketing dept isn't doing a very good job.
Estimate (features) like a boss
Is the type syntax friendly with CoffeeScript?
Well, the best example I know of is proposals to do opportunistic upgrades from HTTP to HTTPS, for example via a browser header in the HTTP reply. If the browser performs the opportunistic upgrade, and negotiates an HTTPS connection behind the scenes, and doesn't tell the user that the connection was served over HTTPS, then accepting a self-signed cert invisibly in this context makes the user no worse off than not performing the upgrade (and better off against an adversary who's not currently performing an active attack).

I forgot what the current status of drafts proposing this is. Amazingly, I found that Rohit Khare described a form of this mechanism way back in 1998 (so it's not a super-new concept).
Web Application Manifest Sample
I'm not sure it really matters that rpm and deb solve the same problem unless you use different distros.

However npm, gem, pip, composer mostly solve the same problem, but a different one to rpm, in that we want per-project dependancies rather than per-system and want them to be commitable. Also many project combine languages so it would be good if these were combined.
Having a separate FromAddress and ToAddress serves a somewhat similar purpose to labeled arguments. You can't mix them up, and you are informed if they change.
Trusting one person simply because they're cool, with the privacy of 600M users, is pretty foolish. Even if everything you say is true, and Moxie signs off on the implementation, nothing prevents men in black suits turning up the day he leaves and suggesting they introduce a subtle bug.
Awesome work! Just got a subscription.

Glad you have a digital-only subscription too!
The United States of Thanksgiving
Will this new index be accessible via the Twitter API? It seems like this only impacts manual searches via the web/client.
Interesting to think that half a trillion tweets is about 70TB of data, and that can be stored for about $10k/year in Dropbox.
agree completely and it's worth noting that i don't have a solution to the issues i mentioned, either.

leveraging other (potentially-insecure) paths to establish trust might help further enhance confidence in authenticity; e.g. verification using something like the broad-based strategy of moxie's perspectives (except via plaintext) or maybe through additional verification of plaintext on the site as fetched via tor or retrieving a cached copy of the site securely from the internet archive or search engines.

dvsni and multipath testing sound quite interesting, and i think defense in depth is the right approach.

having been at akamai's recent edge conference, i didn't hear much from them on this. does anyone have any additional details of their interest in the project?
Moments of Magic
The One Incredibly Simple Secret to Becoming Successful at Anything You Do
Hi, I'm Avik Chaudhuri, I'm one of the authors of Flow, and I'll be happy to answer questions.
How to use Google's large-scale graph processing architecture Pregel in ArangoDB
True, but signatures help statically verify that side-effects can't happen at a call site, giving you reassurances that it's non-side-effecting. Same with referential transparency, I believe.
It's mindblowing that something so statistically illiterate gets published. There is no way they can have the data to distinguish 23 from 0 (or 50) to any degree of confidence without actually enumerating the victims.
They will likely raise much more than 100 million. That is the "default" setting for the S1. Also, if the IPO goes well expect the underwrite to green shoe some more.
Nothing in the title indicated that it was about legislation that could significantly impact the power of the security state to spy on the American public. I thought Obama was legalizing torture.

So why would I read it?
Winglights – versatile turn indicators for cyclists
Building a Business and Making Your Mark
If IBM is trying to show their aptitude for designing frustrating user interfaces

This is basically the latest version of Lotus Notes.
The UI might not be great, but anything is an improvement over the old versions.
Teaching Hidden Complexity  in HS K12 CS
Abiogenesis is one of those things where there is way more speculation than evidence. Some speculation says that it is because the molecular machinery maintenance to handle both would be twice as taxing for organisms.

Of course, having the reverse isomer molecules would be advantageous against predators (who couldn't digest it) and a boon to natural selection.

Like I said, plenty of speculation to be had.
These are all excellent points. As for practical example of recursion, I'd have to say anything implemented with a tree would be a good example.
Wouldn't help with google though - anybody who tried to fake a google cert would be caught by chrome within a few seconds. There is a lot of value associated with owning a browser. Enhanced security is just one of them.
Although such scheme is indeed safer than HTTP (protects against passive attacks), what you're describing is not self-signed certificates, but merely encryption (with new random _unathenticated_ keys per session).

Keys would be exchanged via Diffie-Hellman as usual, but a certificate wouldn't be involved since it's useless anyways (you can't certify anything in such a scheme, why bother at all?) and thus would be vulnerable to active attacks.

Certificates imply long-term authentication. It's an important nuance since they are long-lived by definition, so they have to be trusted and revoked as needed, in which case we're still facing the problem I mentioned earlier.
That is quite impressive. No type annotations needed, and control flow is taken intro consideration (hence the name I guess).

If I am not mistaken, this tech could be used to build IDEs roughly similar to whats available for Java, couldn't it?
I know it's very early, but just curious if anyone is working on a node binding for this, or if one exists already? Would love to try it out in our stack, but it would require a javascript interface.
Seems fairly analogous to the Barbie story that this woman's website broke and now other people are jumping in to help.
Yeah, that jumped out at me also, and is likely to give the story legs considering the pushback against sexual assault in the military.
Samsung Simband – Watch the last video
Basket Starfish in Indoneisa Waters
I really appreciate FB splitting off their features into products. I use the Chat app a lot more than I was expecting. I seldom view the "news feed" which is mostly garbage for me. I look forward to an "Event planning" and calendar integration...
Hey Hackers, any guesses as to how these guys work?
Methodology here:
http://d3mj66ag90b5fy.cloudfront.net/wp-content/uploads/2014...

The TLDR is: they surveyed broadly representative demographics of nine countries on whether any family members had ever been forced to work, and kept in that position by coercion.
They also used some secondary sources for ten other countries.

They extrapolated the figures for the rest of the 167 countries based on averages of countries considered to have similar characteristics, with some largely subjective country-specific adjustments.

As an example, the score for China, which they note has few confirmed reports of widespread slavery was
(average proportion of slaves in Japan, South Korea and Taiwan).9 + (average proportion of Qatar, Malaysia, and Saudi Arabia).1

Worthy as the objective behind the research may be, it's difficult to understate how speculative these estimates and the percentages reported to a ludicrous number of decimal places actually are.
Can't you just remove the cert from your OS/browser's trust store? I can do this on Ubuntu + Firefox.

Incidentally, I can also add my own CA.
I think far, far more people will find Emil Michael's statements unacceptable than not. Including, I think, Uber itself.
How illegal it must be if prosecutors are willing to do so much to keep it secret.
Swift and Go: Building a Fast Future
New York City lowered its speed limit to 25. Other cities should do it too
Same thing, but saying COMODO is invalid CA. I can't remember deleting any root certs, but it must just be me. Strange.
Pretty confusing.

My guess/hope...

This is aiming to be GMail + Google Now for the enterprise. Something that will parse your mail, schedule and contacts to generate suggestions or reminders and create an easily accessible "context" for each.

A workplace client that can generate 'cards', reminders and contextualize common bits of information (Think UPS tracking numbers in GMail - applied to support tickets, physical sites, projects, POs and budgets in an enterprise) with the creepy accuracy of Google Now would actually be interesting - yet another take on unified communications or a skin deep re-imagining of email would not.
The box it comes in has a fingerprint pattern made out of the source code as decoration. It's a pretty cool design decision.
But that don't protect you from a malicious user hijacking this domain in the next cubicle. Perhaps, if your switches are not properly configured , that the guy in the next cubicle ou do some arp spoofing and https://intranet.yourdomain would be served by a bogus server collecting passwords.

But your users won't notice the difference, because they are used to see the certificate warning on his browser.
And then if you're missing a key in your object, your program blows up at runtime.
If you want to build a huge business, building a platform where other people can make money using it is a great way to do that. eBay, AirBnB, Uber/Lyft/etc, Teespring. Even Google, with their adwords product (and reddit with it's self serve ads).

There's lots of great businesses where people pay you for a service, but if you can create one where people make money when you do, they are heavily invested in your success.
Also worth listening to the More Or Less podcast on BBC r4 where they interview the Economist journalist involved.

Specifically they found that the NGO behind the slavery index had taken some countries where there was no data and simply assumed that country had as much slavery as a similar country (nearby, similar population etc)

Then they ranked countries. And named and shamed.

It was not good statistics.
The blockchain can't fix this problem - it's too large for most embedded devices, which do matter. It isn't a solution just because it's a 'cool new crypto idea' to every problem on the planet. Just because something uses crypto doesn't mean adding the blockchain to it makes it any better.
The EFF has a bad track record in this area. The last time they tried something to identify web sites, it was TRUSTe, a nonprofit set up by the EFF and headed by EFF's director. Then TRUSTe was spun off as a for-profit private company, reduced their standards, stopped publishing enforcement actions, and became a scam operation. The Federal Trade Commission just fined them: "TRUSTe Settles FTC Charges it Deceived Consumers Through Its Privacy Seal Program Company Failed to Conduct Annual Recertifications, Facilitated Misrepresentation as Non-Profit" (http://www.ftc.gov/news-events/press-releases/2014/11/truste...) So an EFF-based scheme for a new trusted nonprofit has to be viewed sceptically.

This new SSL scheme is mostly security theater. There's no particular reason to encrypt traffic to most web pages. Anyone with access to the connection can tell what site you're talking to. If it's public static content, what is SSL protecting? Unless there's a login mechanism and non-public pages, SSL isn't protecting much.

The downside of SSL everywhere is weak SSL everywhere. Cloudflare sells security theater encryption now. All their offerings involve Cloudflare acting as a man-in-the-middle, with everything decrypted at Cloudflare. (Cloudflare's CEO is fighting interception demands in court and in the press, which indicates they get such requests. Cloudflare is honest about what they're doing; the certificates they use say "Cloudflare, Inc.", so they identify themselves as a man-in-the-middle. They're not bad guys.)

If you try to encrypt everything, the high-volume cacheable stuff that doesn't need security but does need a big content delivery network (think Flickr) has to be encrypted. So the content-delivery network needs to impersonate the end site and becomes a point of attack. There are known attacks on CDNs; anybody using multi-domain SSL certs with unrelated domains (36,000 Cloudflare sites alone) is vulnerable if any site on the cert can be broken into. If the site's logins go through the same mechanism, security is weaker than if only the important pages were encrypted.

You're better off having a small secure site like "secure.example.com" for checkout and payment, preferably with an Extended Validation SSL certificate, a unique IP address, and a dedicated server. There's no reason to encrypt your public product catalog pages. Leave them on "example.com" unencrypted.
"Meaning it's possible that it could mean two different things in the same file."

If you're spanning languages, that's not unusual. I have Haskell code with C in quasiquotes. What's x /= 2?
How does this compare to StartSSL?
press my brand new coinbase tip button at http://mm-studios.com ; )
You think the people at the WSJ should work for free? I think that's absurd.

Have you never attempted to read original scientific papers? Most are hidden behind paywalls. Search for yourself - http://www.ncbi.nlm.nih.gov/gquery/
If you touch nix at all you have tons of command line tools that require runtimes. Those runtimes were just prepackaged with your distro.

I'm glad you've had a good experience with godoc. My experience with other syntax scanners in other languages is that they always get things wrong. By the time you've added tags to correct the mistakes, you've done more work than doczar would've required you to do.

"Comments are most often read in the code in plaintext" which inspired me to make a new syntax that's more human legible in the source. If you only need to document an argument as being a Stream, it's as simple and clear as `@argument/Stream reader`, no useless sentence of text necessary. edit - or `@argument/Stream* reader` or `@argument/Stream[] readers`.
It doesn't yet, unfortunately. There's a related feature request for syncing user added certificates:

https://bugzilla.mozilla.org/show_bug.cgi?id=583935

But syncing which certificates to delete is probably a much harder sell.

At least there's a way to do programmatically:

apt-get install libnss3-tools
certutil -d /home/$USER/.mozilla/firefox/$FIREFOX_PROFILE -D -n $TARGET_CA_NAME
My daughter once broke the "family computer" trying to install "Barbie Dress Designer". In the late '90s, we had a relatively high-end computer with a reasonable hard drive but the kids had A LOT of software. When the installer told her there wasn't enough hard-drive space, she went looking for applications they didn't use and since "we never play win98", she deleted that folder. The computer was soon upgraded to WinXP and the kids had were provided with unprivileged accounts.

This unfortunate Barbie story has a happy ending ... my kids developed a fearlessness when using computers which is precisely what I'd hoped. Next spring my daughter will finish a combined undergrad/masters degree in Biology (she's a molecular geneticist) and switch universities for a doctorate program. She's had no problem understanding the general logic concepts involved in computer programming including a rigorous course in bioinformatics (using Python).

So how do we go from Barbie to CS? I'd say skip the Barbie completely, but if that won't work in your household, then temper it with equal time on nerdy pursuits. And if you ever run into the "Barbie Dress Designer" software? Buy stock in hot pink Inkject cartridges ... it will empty them at an amazing rate.
It could be a 'frozen accident', where either one works but once a positive feedback loop starts one version crowds out the other.
How this compares to TypeScript? At the quick glance I noted:

- more powerful type system (union types, hurray)

- support for JSX

- no windows binaries

- supports more of ES6 stuff

- ...but has no support for modules yet

- no generics (??)

How about performance? and workflow? Didn't yet find this: does it use a normal "write then compile" model like TS or has something like Hack (if I'm not mistaken it has a daemon running in the background, checking the code as you write it).

Wonder why FB decided to roll this on instead of using TS.
Always thought facebook can challenge meetup.com, will wait to see if like minded groups will use this with referal only entry
Static analysis is definitely preferable to cross-compilation and this looks like a great tool. That said, the idea that static type checking makes developers more productive and prevents tons of errors is overstated imho. Type inference is supposed to make coding simpler and more productive (particularly in functional languages) - even C++11 has added it. I'm sure static type checking can benefit some organizations, but in my experience, type related errors are usually easy to find and fix and have rarely if ever been the root cause of our most difficult problems. Dynamic type checking and implicit conversion is one of the more powerful features of JavaScript and certainly no less prone to error or counter-productive than type-casting, making variadic functions or class templates are in other languages.
Or in your pocket for that matter - yes, the acoustics are pretty much good enough to pick up everything you say.
The other way around. The link you gave is a duplicate of this post actually.