skysight-inc/HackerNews huggingface dataset:
Boilerplate code for classes in Python? WTF?

Are you sure you are not adopting Java or C++ conventions?

Python supports both OO and functional paradigms. For any project you would use the combination that is optimal for the project. Forcing the use of one or the other without considering the overall impact is unwise.
You are missing my point, privacy from data brokers and advertising industry :)
Ask HN: What can a startup expect to spend on hosting?
Hey,
I'm curious about what kind of money a "healthy" startup can expect to spend on hosting in the first year(s).

I say healthy because I am not assuming full on hockey-stick growth, but enough that you are clearly on to something.

I'm planning to use AWS, but I am open to other suggestions and would love to hear some comparisons with other services.

Thanks!
I write software, and the amount of times I even have to explicitly manipulate numbers in a given week is very close to zero. Even iteration is done through iterators instead of indexes, so writing a plus sign is done pretty sparingly.

Data manipulation beyond "pull out of database" or "submit user input to database" is a lot rarer in enterprise software like this than in scientific computing. I'm not saying it's bad to be aware of it, but software is more than numbers.
We compiled our (Codenvy's) thoughts on the Rocket vs. Docker perspectives and posted it on a blog post today. http://blog.codenvy.com/rocket-rocket-docker/

Our net conclusion is that this is good for the industry as competition induces everyone to work a little bit harder. We anticipate that the end game is that advancements and concepts suggested by Rocket are likely not to make it stand alone, or with very broad adoption, but that there will be enough interest & momentum that we eventually see some sort of alignment between Docker and Rocket. It's what would be in the best interests of all involved, in the end. Seems like the projects could eventually merge.

While some of the tone of the initial announcement had political overtures, which were further amplified by Pivotal (James Watters certainly didn't mind fanning flames), what this could indicate is that there were deep ideological divisions in thought within the Docker community. And instead of the parties finding common ground, the CoreOS team needed to create a new project with PR to gain attention to their ideas. That shows commitment and to a degree, high certainty, in their beliefs. Sometimes it requires one person taking on massive risks to fully convey the power of their position.

But there have been examples in the past of splinters that eventually get mended back into the fold. This wasn't a full fork, this was an entirely new approach. The foundations of what they are proposing are nice gap fills for Docker. So there are many more ways for alignment here than for division.
I've never understood that. Isn't there way more Floride in toothpaste than drinking water?

Also Floride doesn't prevent gum disease right?
"Oh, and virtually no PC on earth has that kind of I/O throughput; a Sun Enterprise server might, but a PC does not. Most don't come within a factor of five, assuming perfect realtime behavior."

Some statements just don't age well ...
Why I support PAS-Intervention #givingtuesday
> God forbid you ever consider buying a Bose or Beats product.

Meh, they're okay, but there are better choices out there.

I've a pair of Sennheiser HD600 and it's one of those things that make you go "holy cow, all the hype is justified".

And no, I'm not one of those folks who think gold-plated cables make a difference. Right now I'm listening to MP3 Internet radio on a pair of cheap behind the neck street cans.
I like this idea. What other info would we want included. I think environment/stack and an email contact would also be good.
Very nice tool. I suggest including some popular libraries (modules) like Text::CSV for Perl.

In fact, every Perl program has already been written, it is just a 'use' away.
You have to ensure the attacker can't measure temperature-induced clock drift, because you can still measure the amount of work the CPU is doing to surprising accuracy. You can probably introduce extra busy-work, or farm the work out to satellite servers whose timing jitter can't be observed at the microsecond level.

You can also run your lookup against uncacheable memory, so that the attacker can't detect hot keys. There's still some memory timing analysis available because of DRAM banking, though.

Security is a process :-)
Ask HN: Best NoSQL methods for Rails
Mongoid, Postgres with hstore, Postgres with the JSON data type, CouchDB?
For the problem mentioned in the post (determining whether a given password is valid), how about using a Trie[0]? Wouldn't this work perfectly in this situation?

[0]: http://en.wikipedia.org/wiki/Trie
Context is the key to getting a better answer to your question. For any sufficiently large code base you would need to adopt some structure, e.g. modules and/or well designed functions, to ensure that the system is maintainable. Classes are just one to encapsulate state and behaviour so it doesn't leak all over the place.
Unable to execute dex: Multiple dex files define Lcom/squareup/okhttp/Address
Although I prefer class oriented programming in Python, I have worked on projects where functions were a better fit to the domain concepts.
The Problem with A/B Testing Success Stories
> As best I can tell, they don't see alternative options.

Soon this will trickle down to college. In many cases, you pay $250K for that too. In many, many fields, you can learn everything you need to know on the internet, and get the job you want by just hustling (often by impressing only a single person with influence in the field you want).

I'm in biomedical sciences, have a Ph.D. and will be a professor at a very good school soon, but I don't give a crap about somebody's degrees. If this line of thinking is invading my world, then you better believe the rest of the economy is getting there too. (I also only got into MIT because I managed to impress one influential person).

Getting ahead in life by going to college is a dying notion.
Top 3 Best Rachel McAdams Movies
Is this what allows me to see the very faint red/purplish glow of IR led's that form the ring around a lot of security camera's?

Or the IR light that is used to photograph my license plate for the license plate tolls?

Or is that just imperfections in the creation of the IR light in the first place?
> Also, hopefully this means fewer divorce attorneys.

Because divorce is bad? Divorce can be a good thing, good marriages don't usually end in divorce, more than likely the bad marriages do. So then maybe because you think people going through a divorce shouldn't have good legal representation? What is your argument?
I guess it doesn't matter to human ears with a well-mastered 16 bits, but the video linked in the OP explains that typically dithering noise is shaped (toward frequencies we're less attuned to). The models used to lossy-compress also typically put more noise in some of the higher freqs.
So I'm not a security guy. And I don't know what kind of constraints Andy's system has, or what attack he was thinking of. But it just didn't seem like there was a need for a "use bcrypt" response since from the context these were not passwords in the classical sense. That'd be an inappropriate operation to have on the authorization fast path.

That said, I think we'd be talking of something like this for a web framework session storage attack:

Assumptions:

- A separate chained hash table implementation that doesn't use any kind of per-table randomization (e.g. like what Perl does for DOS prevention).

- A string comparison function that's not constant time.

What the attacker would do:

- Log in, observe session key.

- Generate on client side other tokens that would hash to the same bucket as the real session key

- Use a timing attack using the generated keys to determine the number of other session keys in the same hash bucket.

- Repeat with new logins until they find a bucket with exactly one other session key.

- Conduct a timing attack on the first character of the other session key in the bucket. (I.e. generate 256 fake session keys all hashing to the same bucket, each starting with a different byte).

- Conduct a timing attack on the second character.

- And so on.

- Once you've found a genuine session key, see whether it granted you any elevated rights.

Seems to me that the only thing that's needed is the ability to generate strings with an arbitrary prefix that hash to an arbitrary bucket. Without giving it too much thought, that seems pretty simple. I must be missing something here since you guys are finding this to be such an outlandish idea. Looking forward to hearing what it is.
Ask HN: Any backup software similar to version control?
Are there any incremental backup solutions that can both

1. Allow you to view the state an entire directory was in at a particular time (ala GitHub when you click on a particular commit)

2. Allow you to view the changelog of a particular file
They both tackle the same spot in time, the crossroad. Blow or getting funded / making revenue. You are right, but that is why I think they are bundeled.
The office of the future may have no seats or desks at all
You can build the same quality of web app in any of the above. The question is how much you'll have to fight against the platform's pain points.

Will you be CPU bound? Will you be memory bound? IO bound?
Will you need to scale? it what way?
What libraries, frameworks, modules etc . . . will you need?
Will your app be isomorphic? Where will you host?

And if you don't have many answers just go with what you're most familiar with.
Who do you think told me what happens? :)
The law school naysayers paint with too broad a brush. Going to a top 15 or so school is still a golden ticket. I got a six figure job virtually handed to me for showing up and being good at school. Solidly 90% of my classmates did too.

There are also massive opportunities for anyone with a bar card to earn a substantial living representing consumers, employees and the little guy in general (due to absurdly favorable fee-shifting rules) even if you can't get a job with a big firm. People who can't find these opportunities aren't looking very hard.
What do u guys think? would this work?
So, hash tables don't really work like this. There's no reason for the "FOOBAR" password to be stored close to "FOOBAZ", if you pick a well behaved hash function. You might get to know how many passwords are on the same hash bucket, but that's it. Furthermore, the authentication will be accessed over a network. The network latency (and it's variance) is several orders of magnitude larger than the possible variations. It would be seriously hard to measure something like this with the resolution needed (nanoseconds). Even if you're taking samples and doing an average based guess, you'd need an absurd number of samples (so a bruteforce attack on passwords would be more feasible?)

Edit: Actually, even if by coincidence you did get FOOBAZ on the same bucket as FOOBAR, you wouldn't be able to easily distinguish from a single comparison with 5 equal characters from multiple comparisons with smaller number of equal characters. Also, if you're getting that many collisions to the point that this is a problem, you've sized your hash table incorrectly.
Perfect. Small world.
Elements of a successful graduate career [pdf]
It's great to hear that. I got real excited when I first saw it launch on my browser. It felt like Bootstrap for mobile app development.

Looks like I figured out what went wrong before and got it running on my emulator and my phone now. Gonna try building something on it.
While a lot of Bitcoin's boom can definitely be attributed to hype, it is also worth remembering how much value was added by the illicit drug trade (e.g. Silk Road). That trade provided some of Bitcoin's long term stability, and given the recent closures and arrest (even on Tor) that market has diminished somewhat (plus the legalisation in some locations).
I'm interested to know the source of this assertion?
Floride doesn't prevent gum disease per se, but it does prevent cavities, which are real money makers for dentists.

You may only brush your teeth 3 times a day, but with fluoride in water you're exposing your enamel to it more frequently especially if you're a child who's drinking water often.
I hope its not too late for me to get locked into a platform with an unclear pricing model. I love mid-project curveballs!

"Ionic is currently in alpha testing and is free during that period.
We will announce billing information and pricing plans in the coming months as the service matures."

I guess the adage applies -> If you have to ask the price, you probably can't afford it.

http://docs.ionic.io/overview/billing/
Awwww, all that an no mention of Prolog or Mecury? Prolog is a declarative language that is being used in the real world and being used often to solve interesting problems too. There is always a joke about how folks tend to reinvent lisp while trying to extend their language. Same can be said for any program that has rules, there is always a half ass prolog engine poorly implemented.
With Btrfs the default on openSUSE, when will other distros follow suit
How to Beat a Polygraph
The simplicity of the source code makes me want to revisit meteor
When someone spends money on something in a silly way, do you consider them to be an idiot? Would you make the same statement about someone who spends 200$ on a bottle of scotch versus buying a 35$ bottle?

Let the 'idiots' spend their money driving an industry that is combining the creation of electronics with functional art. I'm not sad to see a $40,000 DAC. I don't have to buy it, and it's cool to know someone built something of silly 'value'.

For example, look at this thing: https://www.naimaudio.com/statement It's absolutely silly, and the cost is outrageous. I'm happy that they built it though. It was actually built as part of the acquisition that Focal made of Naim. It seems that they allowed the engineers at Naim to go nuts once the company was acquired.

I like seeing silly things that people build. It doesn't make me sad that someone spends thousands on ridiculous items that from an engineering perspective don't make a difference.
Indeed. The two main differences are that I didn't care about returning {-1, 0, 1} to emulate `memcmp`, and that I don't rely on implementation-defined behavior (signed shifts being arithmetic).
Ah very useful links. Thanks ASquare!
Programming Modern Systems Like It Was 1984
iSEC Partners - San Francisco, Seattle, Austin, New York City - Job Title - Security Engineer; Security Engineering Intern

You will spend most of your day thinking about security systems and how they can break. This is a very creative job that gives individuals a lot of freedom to be clever while learning new technologies at a very fast pace. Typical engagements will pair you with another experienced security consultant who you will learn from and teach along the way. Engagements are usually 2-4 weeks long. In a year, you will be exposed to 15-20 products and technology stacks. Your work will typically initiate person-months of security improvements in products millions of people use. You will have access to senior engineers/architects and your findings/ideas will be heard by senior decision makers. You will have enormous impact in making the software people use safer. All of our consultants are also security researchers, with dedicated research time.

Check out some of our research work here:

https://isecpartners.github.io/

Check out all of our career opportunities here: https://www.isecpartners.com/about/careers.aspx
History is littered with civilizations that had an extended period of corruption and decay before their final collapse. Rome is one example - its "death" arguably occurred over most of a century.

Anyway, your argument is really weird. It implies that all existing regimes are optimally fit since they exist. But that's clearly not true.
Not practical, there are infinitely many functions that could produce such result

here is such psuedo code
foo(x) { if (x <= 5) { x * 2 } else { x } }
foo1(x) { if (x <= 6) { x * 2 } else { x+1 } }
foo1(x) { if (x <= 7) { x * 2 } else { x+2 } }
> That makes sense when you have an analog version of the audio picked up by an analog transducer (i.e. a vinyl record) but makes no sense with an isochronous stream of quantized samples.

Well, the isochronous stream is picked up by an analogue transducer, isn't it?

> I suppose it's theoretically possible that some extreme warping or vibration could cause a bit flip, but that's what the ECC is for.

Well, at least you allow some doubt. With extreme warping, e.g. hitting the player slightly, you could easily bring the playback to a stop. Now, I don't know how weak a vibration we are talking, nevertheless it's clear the ECC in Audio-CDs is weak (e.g. ignoring the byte of lower significance? I did read about this somewhere, also related to an HN comment), but you barely addressed that.
I attended law school in NY starting in 2007. By the time I was looking for an internship at the end of my first year, the economy collapsed. As a result, it felt like the whole premise of law school (at least for most students), namely that you could get decent grades and would have a high paying job at some firm upon graduation, was completely shattered. This turned out to be completely true for the majority of people who attended at that time. Everyone was trying to find internships at the end of their first year, but there just weren't any to go around and people who had received offers in their third year were seeing them slip away.

I remember thinking at the time that given the economy and the massive layoffs that were occurring that applications to my school would be going down, but what I saw was quite the contrary. Every semester, droves of new students packed the hallways. People seemed to be using the economic downturn and poor job market as an opportunity to "invest in the future" and go back to school. But I just couldn't understand how tuitions could stay propped up and I felt there had to be some correlation between the salaries/availability of jobs post law school and the high tuitions. Again, to my shock these facts just didn't seem to matter and it seemed to me that the whole law school thing was just a big ponzi scheme waiting to collapse.

I know this is all anecdotal and my own experience, but maybe I was right and the big correction has finally come.
This doesn't look like a straightforward attack, but it seems plausible and worth exploring. I think the word "password" just turned my brain off --- in part because I see so many people obsess about constant-time comparison for password hashes.

That said, 'tedunangst's suggestion to hash before comparison seems sound; double-hashing is an old hack people use to do timing-safe comparisons of normal hashes, too.

So I'm still not sure you need timing-safe containers or timing-safe indices, although it's interesting to think about how you'd design them.
Apple's Time Machine keeps daily (or more frequent within a given day) snap shots of all of your folders.[1]

Also, in any native OSX app each "save" works like a git commit, you can browse all "versions." [2]

Combined, these native OSX features do exactly what you want.

[1] http://support.apple.com/en-us/HT201250

[2] http://support.apple.com/en-us/HT202255
So, uh, we can measure the frequency response made by headphones.

http://www.innerfidelity.com/content/headphone-measurement-p...

http://www.headphone.com/pages/evaluating-headphones

This is a pretty scientific matter - when I say "the purpose is to reproduce the input sound", we can tell exactly what is supposed to be reproduced, and we can tell exactly how capable the speaker is of reproducing it.

Some exceptions have to be made due to how having headphones on your head causes the sound to change, but again, these are pretty much known quantities - to get the equivalent of a flat response from a speaker, you will see change X in bass response, change Y in treble response, etc for headphones.

It's not a question of esoteric "The artist and recording engineer meant for this to be played on Kef blades powered by a Cary tube pre-amp feeding into a Mcintosh amp setup using a rail to rail ladder DAC", but a "We know how frequency response should look when measuring equipment and if it doesn't look like that then the sound you are getting out of it is different than the source material"
Author is an expert, and correct. In the linked video he mentions that the difficulty of creating a sharp analog high-pass filter is in practice completely mitigated by oversampling, which is described in the Wikipedia article on DACs.

Suppose you have a 96khz DAC coming from your computer. Surely you see that a computer can solve for the nyquist reconstruction of some lower sample-rate recording (e.g. CD audio) to that sample rate, and then (still in digital 96khz) remove ALL the noise between say 21khz and 96khz, at which point a final analog filter will have an easy time leaving 0-21khz unmolested while killing all higher frequencies, right? It's practically implied by what you wrote. Per what OP says, that's more or less the effect of any DAC you'll use today.
The 3D scanning of Obama
Survivorship bias (2012)
1.) VEEAM for VMware or Hyper-V does this job. You can access restore points at a specific point of time.
2.) Never saw a file-diff tool implemented in a backup software. You may only have backup logs for your incremental backups about the size, duration, etc. If that's what you meant by view changelogs of a backup file.
The Biological Evolution of Pain
Exactly! I would actually argue that if anyone wanted to buy the whole company tomorrow, they would probably have to pay at least 4-5x premium to today's valuation (purely illustrative/gut figure, I have no inside knowledge here aside from what's publicly known).

Stripe is simply one of the SV's greatest hits and has a ton of upside and real option value. Any investor who got in today understands that and would have no good reason to sell for anything less than a really nice premium to where they got in.

Simply put, in the current market their IPO would literally fly off the shelf, they would get great institutional public investors and have a ton of good growth financing options available to them down the road (follow-ons, converts, heck even straight debt soon). Every investor in the deal understands that very well. Having said that, the investor roster doesn't look like a pre-IPO round (I suspect they would have likes of Templeton otherwise), so they will probably grow the company quite a bit more before they hit the public markets (needless to say - a smart move).

At any rate, I completely agree that pointing out that the preferred is more valuable than common is red herring. Theoretically yes - but in this case and in the case of every great late-stage private company, I would argue that the price of the common >= price of the latest preferred round.
Why Twitter Walked Away from a $1B Music Deal
The interesting fight is actually the next level up from OpenStack (or AWS, or vSphere). It's in the PaaS space: Cloud Foundry and OpenShift are sprinting to be the full-service cloud an enterprise can run in a private datacentre.

I have a dog in this fight -- I work on Cloud Foundry. Naturally I think CF's tech is better, especially our next generation of controller/staging/execution/health management (Diego).
Why do we have to bring the person back?
Just use Git (sans GitHub) for whatever you're doing. It works quite well on just about any content (although viewing changes/merges is a little more difficult without setting up special mergetools and difftools for special files like images)
Which would YOU prefer?
I develop enterprise software, too, and I definitely think it matters there, too. You better make sure your database columns have the correct number type or you will get in trouble if your inventory numbers or monetary values start showing rounding errors.