skysight-inc/HackerNews huggingface dataset:
SEEKING WORK, based in Estonia (GMT + 3) half the year and the rest in London, Remote Projects Only.

I've' been contracting for Google for the past six months. I wrote the backend and the data tools for Google's http://consumerbarometer.com/en/

I'm a full stack developer with 12+ years of professional experience.

I write a tech blog which sees a few thousand readers a day: http://tech.marksblogg.com/

I've done both back- and frontend work for BAA (projects for Heathrow, Stansted and Gatwick Airports), Bank of America Merrill Lynch, Blackberry, Bloomberg, British Telecom, Danone, Financial Times, Ford, Google, ITV, Krispy Kreme, Nectar, News International (now News UK), PricewaterhouseCoopers, Pizza Hut, Royal Bank of Scotland, Royal Mail, T-Mobile, UKTV, Vertu (Nokia subsidiary at the time), Williams Formula 1 Team and Xerox.

I specialise in Python, Django, Go, Postgres, Hadoop, Spark, Elasticsearch, Solr, Celery, RabbitMQ, ffmpeg, Google App Engine, Google Compute Engine, Amazon EC2, Cloudfront, S3, Linode, Digital Ocean, Capistrano, Rubber, Fabric, Jenkins, HTML5, CSS, JavaScript, Yeoman, Grunt, Bower, HTML5, AngularJS, backbone.js, D3, RESTful API design. I'm a big believer in test-driven development.

My email address is at the top of my CV: http://www.marksblogg.com/cv

LinkedIn: https://www.linkedin.com/in/marklitwintschik

I hold both a Canadian and a British passport.
I have to agree with the parent here... There are other ways to add security, and having an obscure error message doesn't really improve things by as much as the error message can cause real users to go down the wrong path.
ListRunner

Location: San Francisco, CA (Happy to help with VISA)
Position: Front-end dev - Full Time

We're a small team tackling a very important and challenging healthcare problem: Better communication between team of doctors. Think of it as a bug tracker for doctors.

It's hard to believe but doctors are still stuck managing hundreds of patients without proper tools to keep track of critical information. They still use paper to assign tasks between them. In some departments they have an intern walking around with a big whiteboard where they write tasks on it! It's illegal for doctors to use email, whatsap or any other good project management tool because it's not regulatory compliant with patient data. It's also not adapted to their very intense workflow.

We're a team of 5, recently done YC and raised a good seed round from excellent investors. More importantly, we're getting amazing excitement from doctors and ListRunner completely replaced their paper patient list.

We're looking for a very good front-end developer to join our talented and passionate team.

We moving really fast and are looking for someone who likes to move even faster!

Please reach me at phzbox @ gmail if you are:

- Passionate about web technologies (We use React, Angular, Gulp, and aren't afraid to use the best tool to get
the job done)

- Want to have a real impact on improving healthcare.

Learn more at http://www.listrunnerapp.com
The precision of motion of a stepper motor is several magnitudes higher than a simple DC motor. For a project that needs weeks to execute I wouldn't save the few bucks for a micro.
They should allow login by email instead of username
Gmail allows you to use email+whatever. A lot of sites actually support this and this means it becomes significantly harder to determine what sites you use as each email+whatever is considered unique.
I'm just not that interested in either proving or disproving a general statement that I don't have sufficient evidence to adjudicate either way. Plus, how would pg even argue for it? "In YC W13, these ten founders were all total assholes and their startups all failed. These seventeen founders were really nice, and all seem to be doing well today. These four founders are ok but have a mean streak, two of them failed and two are actually doing well. In S13..." See what I mean? It's not the kind of point that lends itself to data-driven arguments with publicly available evidence, and it would have been really boring to read an essay that unfolded that way (and practically impossible for pg to get away with writing it).

So what's the rational thing for me to do as a reader? What I did was to say, "I wouldn't know, but I'm curious to see where you're going with this", and it turned out he went somewhere interesting with it. Whereas you just shut your brain down because you could think of a half dozen sensationalized examples of people you've never met and missed out on getting to read an interesting essay (that incidentally also explains why, to name two examples, Bill Gates and the Uber founder are exceptions to pg's rule).
>Non-agreeableness is not the same as meanness.

You are wrong.

Disagreeable individuals place self-interest above getting along with others. They are generally unconcerned with others' well-being, and therefore are unlikely to extend themselves for other people. Sometimes their skepticism about others' motives causes them to be suspicious, unfriendly, and uncooperative. People very low on agreeableness have a tendency to be manipulative in their social relationships. They are more likely to compete than to cooperate.

Do you have any actual knowledge of the Big Five psychometric scales, or are you just saying that because you want it to be true?

Disagreeableness is a scientifically validated and incontrovertible synonym for meanness.

Agreeableness is a personality trait manifesting itself in individual behavioral characteristics that are perceived as kind, sympathetic, cooperative, warm and considerate. In contemporary personality psychology, agreeableness is one of the five major dimensions of personality structure, reflecting individual differences in cooperation and social harmony. People who score high on this dimension tend to believe that most people are honest, decent, and trustworthy.

Agreeableness is a synonym for niceness.
>If the user has already signed up, send them a helpful "hey, you've already signed up" message in their inbox.

Well put. Im also a fan of 'If this wasn't you, click here' link within the email to more positively ID the request as malicious
See my comment here https://news.ycombinator.com/item?id=8683425
But since the hack day there has been a pretty reasonable (IMO) GitHub discussion about the tradeoffs between out-of-box ease of use and customizability.

https://github.com/docker/docker/pull/8859
REMOTE

SpiderOak - https://spideroak.com - https://blog.spideroak.com/20141201135441-now-hiring-another...

We're a Zero-Knowledge cloud file storage/sync company dedicated to helping people store data in the cloud without fear of who or what may be reading it.

We're looking for a Python-centric web developer to join our marketing team to help maintain the website, build out landing pages, and otherwise do what needs to be done on a development side to help get out the word out about SpiderOak and what we can do for people around the world.

For more information and to apply, please see the above linked blog post.
Maybe there is no solution. For billions of years populations have wanted to expand and been kept in check by eventual predators and death etc. We humans may be driving towards the same fate.
I think that could also be solved relatively easily. Just flash that you are sending an account activation email to the person trying to create an account and email the already registered user with a notification that someone tried to sign up with their email address.
I'd always wondered why no one seemed to notice this. I guess someone finally has.
That will cost you dearly in terms of user retention.
The whole point of 'unobtanium' is to draw attention to the allegorical nature of the film.
> Some hospital systems have billions of net income, they can clearly afford to fund at least a few residencies.

What incentive, economic or otherwise, exists that would cause them to do that?
Build your own exobrain
Thanks for this. I updated the post to add this as a possibility.

This adds more friction in the signup process than I'd be willing to accept, but it does solve the information disclosure problem.
This is the actual concern. If you require an email check before someone messes around with the product, there's a potential dropoff that people can (rightly) be concerned about.
From an email I received 30 minutes ago:

"Sign-ups are beginning today in South and Southeast Austin. We’re starting with these neighborhoods, and will be opening new areas on an on-going basis."

Also, I'm pretty sure that TWC is available pretty much everywhere in Austin.
I have to say I don't completely understand the use case for this?
Tipu’s Tiger – arguably the most infamous automaton of the 18th century
Only if the returned error code timing for a bad username overalps bad password most of the time. Displaying an obscured error only serves to harm the real users and is of little benefit to the system.

Unless you delay all failed attempts to login by a random time of 500-2000 ms, it's unlikely you'll see much improvement in response rates... having such a random delay is probably helpful anyhow.
Good one still remembers it. Do you remember Calypso? The end is still the same. Few years will pass, and no one will remember those. Only Google and MS Office. Ah, and mutt for the dedicated.
Benbria (http://benbria.com) - New York, NY - Full-stack Node.js Developer - VISA, INTERN

We are looking for interns starting in Jan 2015. We will help with your visa process. No remote, sorry.

Benbria builds customer engagement solutions for large enterprises. Our product, Loop, is changing how businesses and consumers interact with each other. We are looking for a full-stack developer to join our new NYC office. You will be working with some of the largest enterprises and organizations in the world and have the opportunity to positively impact the lives of many.

We use and enjoy the following: Node.js, CoffeeScript/JavaScript, MongoDB, Backbone.js, MongoDB, Cassandra. You'll be joining our small team and helping us enhance the product by designing and implementing new features.

Who are we looking for?

* Strong JavaScript knowledge, Node.js, CoffeeScript, Backbone.js
* Front-end web development knowledge (HTML5/CSS3/JQuery)
* Web development & full stack experience
* Preference for simple, elegant solutions to complex problems
* A history of getting things done

Nice-to-haves:

* Experience with scaling web applications
* AWS
* Experience building fault-tolerant systems
* Redis, MongoDB, Cassandra, RabbitMQ, Erlang

We also have other job positions available. To find out more or to apply, please visit: http://benbria.theresumator.com/apply/ycASce

http://benbria.theresumator.com/apply
Doesn't matter.

Network latency variance just means you need to sample more. It doesn't prevent the attack.
> Set no maximum password length (250+ characters)

It's important to note that if you take the classical advice to "use bcrypt" (http://codahale.com/how-to-safely-store-a-password/), your password will be effectively truncated at 72 characters.
I think it's less an issue of politics and more an issue of corporate inaction. SF has a tremendous amount of dark fiber already and the city is pushing hard for a proposal called 'Dig Once' that will make it a requirement to lay fiber on any utility/sewer/roadwork more than a few blocks:

http://www.sfexaminer.com/sanfrancisco/san-francisco-seeks-t...
Break the Rules Part 7
>> I didn't reach this conclusion at all. Am I missing something?

He's saying that letting the user know the password is wrong, and not the email address, is a better error message. Since an attacker can simply try to register a new account to check if an account exists.
Faster for the client or for the server?
Also three or so that I'm aware have achieved lactate tolerance, also within fairly recent times. Northern Europe, one in Africa, and I believe a third in south Asia, though I'm not positive of that.

Evolution and selective pressure is a thing. I've no doubt it's continuing to happen for humans, though to what result remains an interesting question.
PlanGrid (http://plangrid.com), YC W12 -- San Francisco, CA / Backend, Web, iOS, Android, Data Science: Full-time

-PlanGrid is a team of 60 construction engineers, software engineers, and ex-rocket scientists, building intuitive, beautiful tablet apps for construction. (Think GitHub for blueprints.)

-We measure our growth in revenue and it's been growing exponentially since the day we launched.

-We have native apps on iOS and Android. Our Web stack is frontend mvc using backbone.js. Our backend is python and runs on AWS.

-We care deeply for our users and stay in touch with them in fun ways. (Site visits, Customer Love monthly 48 hour hackathons, etc)

-Fun perks (all expense paid company trips -- last year was Belize., catered lunches 2x a week, medical/dental/vision with zero contributions & other stuff you'd expect from a thriving Silicon Valley startup)

Sound fun? We'd love to hear from you--send an email to jobs@plangrid.com
>> Exponential backoff (forcing attackers to try again after 1, 2, 4, 8, 16.. seconds) is useful as well.

> Just open a spreadsheet and determine how long it would take to test 1500 passwords.

5.557 * 10^443 average Gregorian years.
Interesting, I've never heard of this. Do you have any links to resources? I tried Googling, but to no avail. "c heap" looks like cheap, and "memory" and "foam" are all about mattressess...
Think a few steps ahead.

These aren't really containers. They're giant statically linked binaries, more or less. The actual operating system is now just a VM host for running containerized giant WIMPs (weakly interacting massive programs). Fast-forward a few years and the host can wither and die and be replaced with a proprietary or custom/fragmented management layer. Linux survives only as an internal pseudo-OS within each mega-binary "container."

Edit: what I was really getting at was that these technologies are patches for the inadequacy of the OS. The fact that we need containers at all stems from the difficulty of managing software installations, configuration, etc on the actual operating system.
What's wrong with a web browser being just a web browser?
DockerCon is this week.
The Real State of JavaScript in 2015
It's important that cultures disappear
So in the vein of: "the future is already here, just not evenly distributed.." Where is this superintelligence being built now? Where do the people here think the first superintelligence come from?
Many of you have probably read, or at least heard about, Peter Thiel's Zero to One. A core concept of this book is asking your self: "What important truth do very few people agree with you on?", I recently answered the question in Quora, and decided I'm going to write an essay for each truth I mentioned. Here's the first part of the trilogy.
The Inside Scoop on Marketing Behind Holiday Game Bundles
"You have labor at ~30% of cost, it looks like it should be more than 50%"

That's because I chose the highest possible machine price and highest possible room construction price I could find on google. Its quite possible an individual installation could get away with a merely average $2M machine and basically nil building remodeling costs, in which case the labor cost percentage would naturally dramatically increase.

I don't trust the google data I found of $100K yearly for energy and service contract. That sounds low. 10% of purchase price sounds believable for high tech devices.

I googled some MRI tech salary data and one tech for a decade is going to be $1M. So merely not installing marble and solid gold fixtures in the room would easily pay for a team of three full time techs and one radiologist doing absolutely nothing but supporting one machine. Which is pretty ridiculous, but I want to estimate high to make my overall conclusion strong.

None the less my overall conclusion stands that it would be a significant challenge to spend, both labor and capex, more than about a third of MRI sales price to provide the service. Looks like quite a nice profit center.
have you seen a consultant neurologist? or a consultant virologist?
> ... go be a lecturer or something.

That's a bit harsh, isn't it? & Are you sure you'd want him to go and propagate his habits by teaching them to others?
So? I'm advocating showing the correct error message... a timing attack is irrelevant in this case.

For that matter, adding a random 500-2000ms timer before returning a failed result would likely be as effective, and not lead to a bad user experience.
How to determine the best approach to removing duplicates in joined tables
Yeah, that would work, but the issue is that if you want to support "every" SaaS company, you need to solve the problem of integrating an SaaS product that does not offer granular permissions. e.g. An "admin" account that could grant/revoke access to users might necessarily also have access to sensitive company data.

In fact, it's the sensitive data that is the issue that will generate the most resistance from potential customers. Companies probably care way less about trusting you with their credit cards than they do with trusting you with sensitive vertical-specific data. THEN AGAIN, people are putting their entire company communication into Slack so who really knows...
Hmm, I do see your point, though I'd propose that usernames are more often than not public information. That's been my experience at least.

The difference for usernames is that they may or may not be shared across services. They're a bit more transient to the average user than an email is, though only a bit.

That said, it depends more on your use case than anything else. If any information is private information, it should remain private. Otherwise, I say make it easier to access that information, and be consistent.

To be fair to those implementing the example login systems as well, not all malicious attackers are hackers. It could be an angry ex who wouldn't necessarily think to try creating a new user before proceeding with their password-mashing attempts.

"Bad login combination" and variants do avoid information leakage. It's just not consistently enforced across all surface area. As another example, I believe Amazon public wishlists are searchable by email. That alone can net you an easy list of logins to brute force or check against existing email-password lists.

I think it's most likely that these services are avoiding the "that username exists but it's not actually yours" conundrum while keeping code (and UX) complexity to a minimum.
DnSimple.com is down and so is my website
Docker's 'new' direction is to direct its attention towards solving the orchestration and management problems involved in actually running infrastructure on Docker.

A number of third parties had begun work on various (sometimes proprietary) orchestration and management systems for creating a reliable/scalable/easily manageable cluster with Docker as a building block. CoreOS is one. But Docker is pushing towards an official, open-source orchestration/management system that threatens to make all of those companies irrelevant.
This reads to me like a more verbose version of "Incorrect username or password." I'd favour the shorter version that gets the same point across.
Docker already supports alternative build systems via docker import.

Realistically, if the stack is broken into a dozen pieces then somebody will create a bundle with sensible defaults (let's call it "CoreOS") and then we'll be back in the same situation.
Find & Form (http://findandform.com/about) -- Boston, Massachusetts

Find & Form is a digital design & development studio in Boston. We are an intentionally small community (8 people) who place importance on the meaning behind our clients' projects, not just the depth of their pockets.

We hire based on potential creativity, curiosity, and desire to learn more.

At the least, the following concrete experience have been beneficial so far:

* Ruby on Rails
* Photoshop/Sketch
* Angular/ JS frameworks
* iOS/Cocoa Touch/Swift/Core Graphics/ObjC
* Android Development
* AWS Security & automation

However, we are small and agile, and we love everyone with similar values.

Personality fit is more important than skill fit.

Please reach out to me:
james[at]findandform.com

Happy Monday :)
Location: Chicago, IL
Remote: No
Willing to relocate: Yes, to major US cities, particularly SF, NYC or Boston.
Technologies: Web (HTML/CSS/JS), Ruby on Rails, Python, Lisp, R.
Résumé/CV: https://dl.dropboxusercontent.com/u/16238897/Avy%20Faingezicht.pdf
Email: my username at google's email service
Github: https://github.com/avyfain

About to graduate from Northwestern University with degrees in Integrated Engineering and Economics. I've had two summer internships in finance tech, and currently I work part time at a healthcare startup. I have experience in analytics/machine learning and full stack web.

Looking for full time Software Engineering or Product Management positions starting around Summer 2015.
Or the phishing was staged to cover direct insider trading.
AIUI the primary reason why the HURD kernel is not finished is that when GNU/Linux became generally usable, it was de-prioritized and essentially turned into a research project.
no, rocket does not require coreos, just linux, see: https://github.com/coreos/rocket#trying-out-rocket
Damn, one time $300 fee for "Up to" 5 Mbps download and 1 Mbps upload. That's like getting free internet for 6 and a half years[1] from current providers after 6 months. And if you want to upgrade you've already got the hardware.

I wonder what the minimum time of undercutting at a loss service they can offer is without it being considered anti-competitive.

[1] They guarantee 7 years of free service https://fiber.google.com/cities/austin/plans/#plan=free
>How can you be responsible for something you have no control over?

In the general case, this is very easy and logical: by unleashing it to the world.

Isn't that the idea behind the "Sorcerer's Apprentice" (famous from Mickey Mouse's version in Fantasia)?

http://en.wikipedia.org/wiki/The_Sorcerer%27s_Apprentice
It is, but with a sufficiently large number of attempts you can account for jitter. A good summary (with links to existing research) can be found here:

http://blog.astrumfutura.com/2010/10/nanosecond-scale-remote...
Geeze, no need to shout!
It's already pretty common to require clicking a verification link in an email to complete registration. If you're using someone else's email on the registration page, you're already doing something fishy, and this prevents you from discovering that the email is already in-use. To a legit user, everything looks normal (and to a legit user who forgot they had an account, they'll get a simple reminder in their inbox when they look for their validation link, possibly with forgot password instructions included).

Of course, this all goes out the window if you're not using emails as usernames.
Profile of Tobi Lütke
I see many of you complaining that this should not be built in to Firefox, that it should be a plugin or extension.

I disagree for the fundamental reason that there is no realistic way to depose Skype or hangouts with WebRTC unless your thing has absolutely massive adoption (network effect).

Now I can trivially video chat with someone who has Firefox, and they don't have to install anything extra.

This will push adoption and recognition of webrtc as a technology, and enable competitive WebRTC based platforms to succeed as well.
It's a done deal:

http://www.woodllp.com/Publications/Articles/pdf/AlexandervF...

Also, it wasn't the time required from contractors that put them into employee status, but the requirements they were required to follow.
Location: Mexico

Remote: Yes

Willing to relocate: Yes

Technologies: C, C++, Qt, C#, Python, Django, Objective-C, Git, JSON, PostgreSQL, Vagrant

Resume: https://www.dropbox.com/s/tigu2j4tvilo1t3/Resume.pdf?dl=0

Email: ivoreroman at google mail
Out of curiosity, why do doctors only prescribe D2? It sounds from your description like there's essentially no reason they shouldn't be prescribing D3, and yet apparently none do.