skysight-inc/HackerNews huggingface dataset:
Lyft Saw Spike in App Usage After Uber Scandals, but Uber’s Growth Unaffected
Soostone NYC - New York, NY - REMOTE or ON SITE

http://www.soostone.com

----------
What We Do
----------

Soostone is a specialized software technology and consulting company centered around predictive analytics in the enterprise space. We work with a prominent group of clients that are leaders in retail, hospitality and travel industries. We combine our cloud-based, SaaS technology platforms with an investigative approach to deploy predictive analytics into real-life optimization scenarios and produce unique results for our clients. Along the way, we tackle numerous interesting challenges including high volume APIs, high volume data processing, distributed computation systems, streaming data aggregation, real-time decision making, machine learning, data visualization, domain-specific languages, library design and highly dynamic (single-page) rich web applications. We also care deeply about contributing back to the OSS community and make an effort to release internal projects whenever appropriate.

You will find brief descriptions for our open positions below; please reach out to us at jobs@soostone.com if interested and would like to find out more.

---------------------
Who We're Looking For
---------------------

Experienced Application and UX Designer

We are looking for significant previous experience and a passion for crafting polished, highly dynamic web applications with an excellent sense of design and usability. Should have operational capabilities in graphics design, Photoshop/Illustrator/GIMP and similar software and strong proficiency in HTML and CSS. A formal background in design is considered a big plus.

Data Scientist

We are looking for a solid background in math, statistics, or numbers-heavy engineering with significant experience working with real world data to produce insightful analyses, sometimes employing machine learning and statistical algorithms.

Functional Programmer

Most of our software stack is written in Haskell, so experience with strongly typed functional programming languages is required. The ability to deliver operational code is essential. Ideal applicants would have a formal education in FP, type systems, etc and demonstrated open source contributions.
As the article notes, you can trivially get around that "privacy feature" by trying to sign up with the email. If it lets you sign up there was nobody there, if it does not the email is being used by somebody else. Most sites will reject you immediately if the email is already in the system.

> RFC 7231[0] suggests something similar

Well no, RFC 7231 suggests that rather than telling an authenticated user he does not have access to a resource you can tell him the resource does not exist at all. It has nothing to do with the authentication itself, and certainly isn't suggested (let alone recommended) as a response to an invalid authentication attempt.

> valid credentials that are not adequate to gain access

How does a clear statement that the user's credentials are valid but don't give access to a resource have any relation with the rest of your comment?
This seems like a messaging problem?

"Password does not match our records for username/email XXX. Please check that both password and username are correct."

Responding to below This reads to me like a more verbose version of "Incorrect username or password."

Note this version is not wordsmithed and could probably be done better but the goal and inherent difference of this to the original is to let the user know that the username exists and that its the password which does not match.
> - have them work extra-hours without compensation

I'm not familiar with German labor laws, but I know this is (typically) illegal in the US and I suspect that can't be different in other first world countries. Is it?
Steel not polluted by atomic-age testing?
If I'm not logged into a site a that I regularly use, I'm probably not logged into my email, either. In order to log into my favorite site with Passwordless, I have to log into my email as well. With my password. One login for the price of two, and I'm still using a password.
How is it illegal to give someone permission to remote wipe your device?
>99.9% of websites on the Internet will only let you create one account for each email address. So if you want to see if an email address has an account, try signing up for a new account with the same email address.

While this is true, it's perfectly reasonable to require a captcha before allowing a new account to be created; greatly limiting the speed at which an attacker could enumerate emails. While it's not going to stop targeted attacks, it will mitigate mass brute forcing of weak passwords.

Regardless of the ease of username enumeration, all of the author's points about what to do are great for most sites. Rate limiting with exponential backoff and 2fa are some of the cheapest and most effective means of increasing the security of your app's authentication process.
If you're hiring we'd love to have you over on https://vacancy.io
Clojure HTTP server with unified API for WebSocket and HTTP long polling
How Feminists Ruined Women's Careers in Programming
The work of Vladimir Propp was better, and more applicable to a wider variety of stories.

http://en.wikipedia.org/wiki/Vladimir_Propp
The lede was buried at the end of the article. “We intend to collaborate with Docker. We can contribute these ideas back to Docker.” I hope that is the case. This will be interesting.
This is an awesome concept. Today's process is extremely biased and we are often passing on the "right" candidate because their resume doesn't hit all of the relevant keywords.
It really seems like Google is more breaking up the existing monopoly. By wanting more people online, viewing more ads, to fund their main revenue source, they're willing to cut connection costs down to the minimum, forcing the existing monopoly/duopoly in many places to also cut down their prices and improve service.

In short, come to Atlanta, Google; I'm sick to death of paying $75 a month for a 300 gig cap.
The book is mostly about the use of the Java EE APIs. As such, it's not all that affected by the evolution of the core language from 6 to 7 to 8.

However, it probably will be affected by the evolution of the Java EE API. EE 6 was a huge, massively simplifying, change from EE 5, which is why it needed a book like this. EE 7 was a fairly incremental change from EE 6, and EE 8 is set to also be a modest step forward.

The biggest change in EE 8 - and i don't know whether to laugh or cry about this - is that Java will be getting a standard web MVC layer. Fifteen years after such things first appeared on the scene, and five years after they became passé. Maybe there'll be an API for controlling dialup modems or AIM clients next.
If the username is wrong, and you don't tell them, they will spend several tries on passwords that will never work.. because the user is invalid.

I have a number of sites I don't use often, that I wind up having to do a password reset on to then find out I'm not even using the right username... there was literally no gain from this... Any hacking attempt can do the same to determine if a username was valid or not.

It's making things easy for machines to do harder for people to do, which is the wrong approach to security.
Thank you I totally agree, and it's been my main concern. I keep telling him "I don't want to be employee #1. I want to be cofounder"
Looks like your twitter account is suspended!
"If you’re uncomfortable donating directly to an individual, please consider making a donation to Cancer Society of New Zealand in Steven’s name."

They will need way more money than this. If uncomfortable giving to an individual, you shouldn't feel this way because this is about giving money to a family in need. This money needs to cover a lot of personal expenses and a soon to be born child.
The most accurate summation of one's behavior is to see what happens when they believe they are not being watched. Asking the children of these startup founders would offer a different perspective, surely. There's hundreds and thousands of stories of famous people that behaved completely different at home than their public and professional images would suggest. In fact, sociopaths typically doing well in business very much helps explain the motivating factors for why people can be regarded so well professionally but hated by their families. But even at home we are probably different than how we are professionally anyway regardless of personality and I'm even different from employer to employer and for the purpose of the thread, that's really all that matters, doesn't it?

Just talking to people at a party or a business dinner is not enough to get any semblance of character judgment aside from some pretty stylistic ones (small cues that say more about preferences than worldview, for example). Even playing golf together can hide monstrous raging alcoholics and serial killers from us all because these people have developed almost split personalities after decades of manipulating people. It's not necessarily conscious either but almost a personality trait like being really energetic, quiet, paying attention to detail obsessively, etc. I say all this as the son of someone that's got the cult leader personality type and how he works has framed how I absolutely refuse to work. Some might argue I'm doing better but I don't think so in terms of the original article context at all.

It should also be noted that pg's sample is somewhat biased against Fortune 500 companies and dysfunctional yet still-in-business organizations that employee so many but repel those like pg and perhaps those he knows as well. Furthermore, the kind off folks that are attracted to in dysfunctional orgs are similar to men that prey upon insecure women. There's similar equivalents for business folks too.

So, in short I think pg has been blessed to still have this optimistic view of any flavor of meritocracy. It's nice to be able to turn away from companies where failure is constant, rampant, and extensively rewarded to these kinds of people that don't do well as leaders in start-ups and even finance. I used to hold his view but after my career I regard it as an idealistic notion.
ITU is looking for rails developers of all skill levels to join our engineering team to help build educational software that doesn't suck.

International Technological University (itu.edu)
Location: San Jose / Remote

We're a fast growing internal software division at a non-profit university specializing in masters and doctorate degrees. ITU has tasked us with building an enterprise grade educational system that meets it's needs helps ITU scale as it operates and opens new campuses internationally.

While ITU is a largely academic environment, we have a fairly progressive work environment. Most engineers set their own hours, we focus on an agile/SCRUM-like iterative workflow, and we're firm believers in TDD and code review.

We also feel strongly that our most valuable asset is our people, and we invest in them. ITU employees get free access to masters and doctorate level courses and we have a dedicated training budge with additional time for personal enrichment (pet projects, read up on some new tech, etc).

If you're interested in working with us, know that you do not need to be a rockstar, but you do need to be able and willing to communicate, learn, and collaborate.

Contact: Damien Wilson <dwilson@itu.edu>

EDIT:

Some points I forgot to mention:

* We're predominantly a rails/node shop, but we're happy to hire good people with relevant experience in different tech stacks
* We are happy to hire remotely, but not for junior positions. We find that more junior software engineers need a bit of training before they're self sufficient enough to be productive.
Obama announces funding for 50,000 police body cameras
This begs for clarification. Lord Vetinari considered ruthless patrician and was prepared for this role at assassins school. Without healthy dose of fear and respect this phrase might come off as condescending.
Nope, it was a pretty good PR stunt. You can see Skeletor on the main Honda site.
It's easier to write a javascript framework than it is to solve the hard problems.
> Unfortunately due to the lack of quality ISP's, the first to offer residential fiber to the perimeter will rapidly absorb the market.

Is there a historical precedent that suggests that this will happen?

The major telcos continue to grow their profits year over year while decreasing their capital spending. I think the much more likely response to any success on google's part will be

- cities growing impatient for their turn and building their own networks (well underway[1])

- more and more attempts by existing ISPs at regulatory blocking of competition (well underway[2])

- finally, ISPs actually increase spending to match speeds (still in the lip service stage[3])

ISPs like their market strangleholds. They aren't going to just roll over. Meanwhile building infrastructure is fundamentally a lot of work, so no "Bell 2.0" is going to be born overnight if they're trying to actually build out a physical network (major ISPs merging[4] as a road to Ma Bell is a different story, though).

[1] http://arstechnica.com/business/2013/11/fed-up-with-slow-and...

[2] http://arstechnica.com/tech-policy/2014/08/how-big-telecom-s...

[3] http://arstechnica.com/business/2014/04/att-copies-google-na...

[4] http://en.wikipedia.org/wiki/Comcast-Time_Warner_Cable_merge...
Not Getting Software Wrong
I'm really sorry to hear about your situation. For me I kind of had the opposite experience with my gallstones. I was just having general issues in the morning (heartburn, urgent diarrhea, and just discomfort) and I couldn't pin it down on my diet. Eating worse made me feel better than eating well. Doctor says it can be multiple things, let's just go and do an ultrasound on your stomach. Within five minutes, yes you have gallstones. Schedule surgery, in surgery and out two hours later then an hour after that I'm at home chilling for two days. Then my doctor explains why eating crappy made me feel better, because the stones were keeping the duct open and bile was coming out all the time, so fatty foods used it up. When I ate well there was always extra bile. Of course fast forward to now and if I eat terrible I will be on the toilet asap.
It seems like if you're going to support querying you should also support "just give me all the content tags", even if that's implemented as running all the individual queries. Especially for example number 1 you're going to find that publishers aren't thinking "Do I have automotive videos to package up for a car brand?", they're thinking "I have no idea what content I have in my network, what broad categories does it fall into?".

My employer, SET Media [1], has built out our own ML / CV system that applies a taxonomy of a bit over 1000 tags to several million videos. We add new videos and re-compute existing results multiple times a day. It's been invaluable for us to be able to query for both a specific tag as well as to see all the tags (and their confidences) that are applied to a video.

[1] www.set.tv
OpenVPN 2.3.6 released – fixes a critical DoS issue
In theory yes. In practice absolutely no. The examples are oversimplified, and when you start using xs:all or xs:choice you quickly start running into inheritance issues (e.g. the top level node is optional, but when it exists child-XYZ are mandatory, and when you mix child optional and child mandatory things get "strange").

I spent a few days trying to get a schema working with our format. I had it working well enough with a specific node ordering, but when I tried to get it working with an order-agnostic set it would all break down around you.

That's when I threw out two full days of work and replaced it with a Java class I spent about an hour writing and testing. Working flawlessly ever since.
marketing, the tv commercial has skeletor and he-man.
that being said, love it.
"Sorry, we don't have a <name> in our database" isn't misleading. If the user enters an incorrect password too, the subsequent message "Invalid password for <name>" will let them correct it.
Externalities and long term planning are known issues. They can be managed by the government to some extent.

Really it all comes down to managing incentives. Obviously capitalism isn't perfect, but I doubt there is a better alternative. Any other system will have the same issues and complexities. Even trying to solve issues with government like I did above isn't necessarily better, since governments create their own messy web of incentives and complexities.
> That's terrible UX.

I think the goal when the User is a malicious attacker is for them to have a terrible UX.
In regards to growing array one-by-one, obviously be very careful with that. In C, issues to look out for are malloc overhead and memory alignment issues if you are not realloc'ing in even sizes. Also see Mozilla's recent post on this issue. [0]

[0] https://blog.mozilla.org/nnethercote/2014/11/04/please-grow-...
My bad. I suppose i live in a bubble just like anyone else. I do think this is a well-known approach within the bits of software culture that talk about scalability. If you're a regular reader of highscalability.com, or a developer at Netflix, or one of the sad nerds who wish they were (eg me), or you've read the Heroku documentation, you've heard of 12-factor. But no, not everyone has, and in particular not every working stiff who shovels Java for a living.
I'm thinking "Node.js for everything." It's way more fun, more productive, and runs small and fast. Forget threads. I too used to believe "Java for Everything." Over it. Write microservices in Node. Build front-ends in Angular. Talk JSON.
> If they invent and implement as many things as Bell I'm almost ok with that.

Maybe, but I wouldn't compare Google with Bell Labs directly.

Remember that the only reason we had access to so much of what Bell Labs invented (e.g. Unix) is due to a 1958 antitrust lawsuit which resulted in AT&T being prohibited from profiting off of the computer business entirely[0]. As a result, Bell Labs had to license all technologies (except for telephone-related services) freely.

It wasn't until 1984 when AT&T sold off Bell Labs - almost three decades later. If AT&T had been allowed to profit off of Bell Labs, we might remember Bell Labs's legacy very differently.

If Google were subject to an analogous requirement that would be one thing, but absent that legal restriction, the two situations are very different.

[0] http://www.faqs.org/docs/artu/ch02s01.html
Really!?! An attacker can just as easily write a script to check the password recovery form before attacking the login form.

You're taking something that is easy to automate and using it as a solution that makes it harder for people to use.

How many times have you been to a site you haven't used in a while to try several different passwords, only to hit the password reset form and discover the username wasn't even correct? How many minutes of your time were wasted? How much security was actually added?

The answers are... Yes. Too much. None.
Also you can 'foam' the heap if you continue to grow lots of allocations. Old freed fragments are never big enough to satisfy a new allocation, and your heap memory grows without bound.
Ahh, your view is that the definition of "promiscuous" varies, and so you can define it any way you want. Where I want to use a definition that more than one person follows.

"Citation needed"

What's wrong with the CDC and U. of Arizona links I gave earlier? And you added nothing new to what I wrote before.

"is still a fact."

It's a boring fact. It can't be used for anything. Why do you even bring up useless facts?
That may be the case if you're just doing in-house software.

If you're writing software that others will be running, the calculation's a bit more complicated. You've got to consider your customers, and how much a performance change impacts their purchasing decision, and use that to estimate your revenue impact, and then compare that to the cost of developer time. And what comes out the other end of that is that developer time is often much cheaper than dissatisfied customers.

The case is similar on the Web, where tiny minuscule barely noticeable changes in application responsiveness can have a huge impact on conversion rate. Or worse yet, make the difference between your servers falling over or ticking along smoothly when that oh-so-important Cyber Monday traffic surge comes along.
I agree with Kevin Burke's post. And I had designed my POC this way well before I read his post. https://lamba-todos.herokuapp.com/
That's because the market is large so that apps have the space to do this.

Same in US, all major players want to do everything on their platform. In China, there are just more such major players.
Ask HN: Are free-dns services reliable?
The plan is to publish a small contact website, on a budget.. thus free-dns + heroku hosting + paid domain

We are expecting low traffic for a couple of months so, any advice?
Agreed. Whenever there's a comparison of our pathetic speeds with those in Korea/Japan, people claim "the US is a huge country", etc. However, San Francisco's density (6600/km^2) is higher than that of Tokyo (6000/km^2); why doesn't SF have FTTH?
ConnectSolutions - San Francisco, CA

Company

We are a 70+ person company with 200+ customers that is over 7 years old. We are one of the largest web conferencing managed services organizations in the world. We have a wonderful customer base including customers like Google, KPMG, Charles Schwab, General Motors, USAID, and many others.

Product

We host Microsoft Lync and Adobe Connect for Enterprise and Government customers. We create software to manage our infrastructure plus value added products and services. Our stack is javascript (node and frontend), java, puppet, and powershell.

Positions
- Engineering Manager / Director
- Microsoft Lync Architect / Senior Engineer
- Security Manager / Director

E-mail me, I'm the VP of Technology (matt at connectsolutions.com).

Excited to hear from you :)
Location: American living abroad in Italy

Remote: Yes

Willing to relocate: Maybe

Technologies: Laravel, modern PHP, MySQL, MongoDB

Résumé: I am from Pittsburgh, Pennsylvania and have worked as a full-stack web application developer in the U.S. until 1999 and Europe since 2009 (Agile, Scrum, Kanban).
Most recently, I have been using a TDD-based approach and the Laravel Framework (XDebug, composer, etc) to build applications running on LAMP/LEMP.
I hold a B.S. degree in Computer Science and have recently become a writer and speaker and contribute to open source projects whenever possible.
I speak native English, Italian, and I travel frequently.

http://linkedin.com/in/chrispecoraro

Email: chrispecoraro@gmail.com
I've not been following the discussions but if it's such a critical piece of the whole puzzle and it's in everybody's interest that it remains open, wouldn't a foundation, rather than a single private company, be the best venue for leading the project forward?
"You don't exist. Go away." is my personal favourite.
I think that smart people in both business and technology are attracted to hard problems that are intellectually challenging. Dealing with the corruption and the entrenched bureaucracy of local, state, and federal governments doesn't qualify as an "interesting" problem for these types of people. It's why you don't see many scientists in elected office.
This may be a noob question,

I'm looking into using containers for ui applications. I need to access GPU within the application. is this doable with Rocket or Docker?

Also does Rocket have to be used with CoreOS?
You didn't really address the parent's point, which is that their misspelled username might match another real username. In this case, telling them that their password is incorrect is actively sending them down the wrong path, because they are likely to try fixing the password field rather than the username field.
What Evernote and Uber deals mean for the future of media