skysight-inc/HackerNews huggingface dataset:
They should expect that, but instead they are getting sympathy in this thread, quite ironically:

https://harthur.wordpress.com/2013/01/24/771/
When transistor size goes down, accelerators which are idle most of the time become cheaper. Your power budget doesn't allow you to run all the chip's parts at the same time anyway.

https://en.wikipedia.org/wiki/Dark_silicon
Significantly cheaper than Pingdom, as there's significantly less monitoring POPs.
You understand that the satisfaction is verified at compile time, right?
In this specific instance, calling the library "incomplete" is a less-than-completely-accurate characterization. What the issue creator wants is easily possible using the library, but cannot be included as default behavior because of licensing issues. This is hinted at, but perhaps not made as explicit as it could be, in the README.
While I have no actual knowledge why they made that decision, its not very hard to guess, and the possible answers are around their own staff familiarity with FreeBSD, the pros of having the platform simplified by using single OS (Linux in their case, since for sure they've more servers with Linux already than they've acquired with WhatsApp) and all possible security and financial implications following these factors. However, it seems like at least for know they might be staying with FreeBSD a bit longer, what's a great PR/recognition win for the FreeBSD itself. I really doubt its for 'licencing issues' because (religious wars aside) the BSD license is way more attractive to businesses than GPL one.

Said all that - I might be terribly wrong about everything I said, because its not an insider knowledge ;)
They could just share UCNs instead.

SSIDs cannot be stored (or shared). But UCNs would function exactly like SSNs in the current system.

SSIDs just exist to "wrap" UCNs, they prove that you have the current SSID for whatever person you're claiming to be (kind of like a poor man's password) and make it more difficult for thieves to re-use the UCN number trivially (you'd have to be an insider to enter a UCN, outsiders need the SSID).

The reason to stop people storing or sharing the SSID is primarily so SSIDs themselves don't become the SSN replacement. Companies might get lazy and instead of converting the SSID at the SSA, they instead "cache" the SSID->UCN conversion in-house or worse just use the SSID directly.

You have to make SSIDs ephemeral. UCNs and SSNs are static. UCNs can be stored/shared, SSNs get outmoded eventually, and SSIDs are short-lived no storage-sharing numbers that provide the UCN.
While the content of the report was fine, the language was not. It reeks of entitlement and is rude towards the people that spend their spare time providing value to others. This is especially true in this case since the projects readme clearly states that it's based on the Phantom Open Emoji library and thus limit to the restrictions of that library. If the reporter really feels like he should raise an issue, then he should raise it with the icon library.
Well, OK, so Klabnik is an asshole, that's hardly news. It's unfortunately true that participating in OSS, as in any shared endeavor encompassing such a large subset of the species, requires dealing with assholes. The current contretemps (and corresponding HN thread) provides a valuable example, for the novice, of one particular suboptimal strategy, its ramifications, how to avoid it, and what might be worth doing instead.

Of course, that's not to say I recommend novices study HN, especially for advice on how to behave -- God preserve them from such a fate! But, should a novice have happened in by mistake, perhaps he'll glean something useful from this thread in those few fleeting moments before the panic takes hold.
Actually you do. There are many cases of Steve realizing he was wrong and changing his position. In his Eulogy Jonny Ive talked about it as one of his best known features.

But this doesn't fit the "steve jobs is a tyrannical asshole and apple's success is only a fluke of marketing and apple is evil" narrative that is so popular among google worshipers.
Remind me about this issue
https://github.com/olragon/meteor-handsontable/issues/6
The app is unbearably slow. I still use it, but it's unnecessarily frustrating. I'd attribute the decline in usage to it taking half a minute to refresh.
I am commonly asked to reverse a C string.

The first time I did that, I wrote out what I regarded as the obvious solution. The owner of the company pointed out that I had paid attention to performance. That had me puzzled - while I could see that there are lots of really slow ways to reverse C strings, I found it hard to believe that anyone would provide slow solutions to such a simple problem in a job interview.

I got an offer the very next day.

It was not long after that I discovered that many of that company's other coders were, while not actually clueless, just not very adept. Like they really would be challenged to write a fast C string reverser.

At least I got the fizzbuzz test right. I've only been faced with that challenged just once, but three times now I've had to reverse strings.
For a moment I imagined someone starting a public relations campaign against a ruby gem.
It's not just PayPal fraud per se. Leaking user's PayPal email address and password has a lot of other consequences. (Yeah yeah in theory you should use distinct passwords for different sites etc etc)
I'm sorry but nothing is stopping you from throwing down $10 a month on a VPN and spinning up an IRC server in the US or in most of Europe and complain about the government or corruption of officials.
There's also Juniper, EMC2, Apple, Yahoo (back in the day, at least), Sony PlayStation and many, many others.
A stereotypical answer FigBug didn't mention was interrupt latency is much faster and jitter in the interrupt latency sometimes doesn't even exist.

Also, closely related to above, simplicity and modularity. Don't want to be the guy debugging why the antilock brakes occasionally miss an encoder transition when the engine RPM fuel injector routine is just perfectly the wrong interrupt rate. Its very much unix vs windows philosophy WRT monolithic-ness.
Yes, but if PayPal's security is good enough, that's everyone else's problem.

(Yes, that's pretty nasty - but is putting a poorly-secured "startup" online really any better?)
That's a mistake, we don't need more than read-only access to your email, I'll fix this soon, thanks !
I think the tax benefits are the withholding taxes being non-existent
In 1977, there wasn't such a popular thing as "Stock options" for going to work for a "startup". This is, quite literally, THE startup that started in a garage and produced the "came from a garage" myth. Further, your dishonest implication that Jobs didn't give up ownership is factually false, and the reality is, he simply gave up ownership to different people than Woz did.

But your comment shows what type of person you are, that's for sure.
Yeah, I don't really see why you wouldn't write down the passwords of social media accounts.
I once worked for a company that got sued by my predecessor, and won. However they spent so much in legal fees, that the lawsuit nearly bankrupted them. The code that my predecessor wrote worked very poorly, so they got bad press reviews, lots of product returns and so on. I was hired specifically because I said I was really good at debugging.

After that, the company owner had a specific policy of not providing references. He gave a very neutral answer: "Our policy is not to provide references." However he was completely cool about verifying employment.

His concern of course was that my predecessor would sue him again, were the company owner to give that guy a bad reference.

Ironically, that same company owner is one of my own references. He's always happy to say good things about me.
Doesn't this weakness potentially exist with any integrated payment page on any site using any payment platform, though?

There is always a level of trust involved with entering these kinds of credentials on-line. This is why some of the 3-D Secure systems make you (the customer) give them a greeting of your own choice to incorporate in the prompt for your confirmation code.

However, it seems that for many vendors the losses due to a higher rate of aborted checkouts make such systems undesirable. Apparently most customers don't share the author's concern here, presumably either unaware of the potential security issues or just trusting that if anything does go wrong then some protection or guarantee from their payment service/card issuer will get it fixed.

I suspect the author here would argue that it would be better for on-line payments to be push transactions rather than pull, so users always actively send money via a trusted party such as their bank without ever handing over their bank-issued credentials to anyone else. No doubt many of us would agree with that; pull-based payment models are fundamentally insecure and absurdly vulnerable to fraud. But again, that goes for a lot more than just PayPal.
What is the best solution for this?
That's because Chrome is phasing out SSL certificates issued using the outdated SHA-1, starting with the minor warning (the yellow triangle) for certificates with expiration date on or after Jan/2017. In this case, the certificate expires on 3/2018.

Ironically, Blue Coat is a security company [2].

[1] http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...

[2] http://en.wikipedia.org/wiki/Blue_Coat_Systems
Huh, this seems very obvious in hindsight. I guess with Stripe things are a bit easier since you have none of this username/password stuff to be dealing with (you could get your cc number swiped, but if you're an American you're dealing with that issue everyday anyways).
Snowden did the citizens of the US a huge favor by bringing to light pervasive government snooping. In the long run, it will be good for freedom* !

* That is, unless the citizens get too distracted by Honey Boo Boo, the Kardashians and so on...
The cool thing is that you get to triage the issues and handle them as you see fit instead of waiting on a senior developer, tech lead, CTO, executive or someone else to give you the go-ahead.

That's the real power of FOSS imo. It gives all programmers breathing room to try and make good technical and social decisions without being subject to too much politics or interference from management.

A sandbox in which to become a better developer and the career/profile benefits are huge.
Not just Erlang/BEAM optimization, but the team's background in high performance, C-based systems on FreeBSD enabled them to achieve massive scale.
Earned $10,120 in 30 Days by Sending Horse Poop to People: Marketing Experiment
In the US, Federal Law, and the law of all the US states that I know about, forbid discriminating for reasons of age against people over forty.

I'm puzzled as to how Zuckerberg could have been so ignorant as to say such a thing. All I would have to do is to apply to Facebook and I'd have a good case - it's pretty obvious from my resume that I'm olde and greyye.

That's not to say such discrimination does not happen, actually it's quite prevalent. It's quite common that I am asked to come in for an onsite interview, but the instant they see me in person, the way they talk it's plainly apparent that I'm not getting the job - before I even say anything. I really do have grey hair, you see, and wrinkles.
NXP's LPC line of microcontrollers are M3 or M4-based and have external SDRAM interfaces that work pretty well (no high-speed layout necessary). They've been around for a while.
Rotating rooms give Sharifi-ha House by Next Office a shape-shifting facade
I also have a folder called "passwords" (actually "pw") with thousands of passwords.

The difference is that they are all encrypted with gpg (via my little pw utility [1]).

[1] http://svario.it/pw
+1

I recently saw a demo of the "Aadhaar" project by Indian government in Nasscom Product Conclave event (in Bangalore). I was a skeptic & still am wary about security aspects of something at this scale by government.

But I was quite impressed by the progress & the use cases [1] themselves. They showed in real time, how a bank account authentication can be completed without bringing any other document.

Just IRIS scanner on a phone / tablet, that confirmed the identify of user by returning a photograph & other details. It was done in seconds with a 3G network. There were a few other use cases demonstrated and was pleasantly surprised to learn there are companies in valley that are building services on top of the API. [2]

[1] Overview of Aadhaar service: https://resident.uidai.net.in/aadhaar-services;jsessionid=B1...

[2] API: https://developer.uidai.gov.in/site/book/export/html/18
What's more fascinating is that erlang underpins many more staples of the internet than most geeks even know. WhatsApp is just one 19B example.
The problem is that Github could open a popup with a form that looks the same, and you wouldn't be able to tell that you're not sending your credentials to Paypal only
Not aware of a UK equivalent of SSN.
Who mentioned Google? Stop making technology companies your sports teams.
Yes. It won't compile.

This check is not really needed as the code would fail when a function which accepts scan.Writer would fail (compilation) if ColumnWriter is sent and if it doesn't satisfy the interface. However, this is easier to debug.
I would start with the Intro to Machine Learning Coursera course, and then the Intro to Neural Networks course. That will get you to a point that you can understand current papers.

The demo I showed actually showed that it's possible to design an algorithm in minutes that previously would have taken years, but combining machines and people. So I do strongly believe that machine learning allows us to create new, better, programs more quickly than before!
You're not getting the core issue - the way real gateway works cannot be distinguished from phishing. "seamless" user experience confuses users and is going to create a whole new wave of phishing
Gonic - causing a desired reaction - might work, though I suppose any correct code would fit that definition. I sort of like gothic - always recognizable, consistent, big.
How browsers get to know you in milliseconds
Yeah but what to stop me from serving a fake popup over https://myfraudsite.com?
A JavaScript pry prototype (pry.js)
Exactly, giving your CC details to some website is a routine, but your email+password are critical credentials.
It doesn't make a difference. Just because a site is SSL-encrypted doesn't make it a site you should trust with your paypal credentials.

The only site you should trust with your paypal credentials is paypal. And the only way to be sure you're talking to paypal is to see paypal in the address bar with an SSL-encrypted session. (At least, that's what the whole web, browsers and CA's alike, have been striving to ensure is the case since the web has had encryption.)
Day 1: Game of Life
The lack of a central authority for names hardly absolve individual library creators/maintainers of the responsibility to choose appropriate names; closer to the opposite, surely.
all i see is, "Error establishing a database connection"
Interesting book: http://www.amazon.com/Organized-Mind-Thinking-Straight-Infor...
https://news.ycombinator.com/item?id=8709837

https://news.ycombinator.com/item?id=8711746
>for a gem occupying the namespace "emoji", I think it's reasonable to expect the full, standard set of emoji.

It may be reasonable, but it's not correct. Unless there's a central authority assigning and approving namespaces for gems, then insisting that authoritative-sounding names actually be authoritative doesn't reflect reality. "Emoji" really doesn't mean anything other than "here is a unique string to differentiate this package from all of the others." Describing what it actually does, or doesn't do or contain, is what the readme is for.

I'm not arguing that namespaces should be arbitrary and essentially meaningless, just that for the most part they are.
This isn't strictly true. The thousands stored in a folder called "Passwords" was actually a curated dump of passwords from various parts of the server that the hackers put together and into its own dump -- looking at the data, it doesn't appear the passwords were saved there originally.

That's not to let Sony off the hook, however. Plenty of passwords were stored alongside the password protected documents [1] and some of the passwords used were insanely bad (s0ny123) [2].

[1]: http://mashable.com/2014/12/03/sony-hack-4-security-lessons/
[2]: http://mashable.com/2014/12/02/sony-hack-passwords/
To log in paypal account password is enough, user-agent and IP/location can be faked. When you're in you get access to user's transaction history. Ouch.
I love future-predicting articles
This is kinda why I dislike Github and JavaScript. There isn't enough friction to force people to stop and think before they ask stupid questions. Previously, things like that were limited to random forums, IRC or mailing lists, "I'm trying to do X, can you do X for me?". Now that lack of culture has infected popular projects that are on Github.

It's strange though that this doesn't seem like a huge issue for projects that have their own issue trackers and wikis...
Justin - you're quite right. NI number isn't anywhere near so powerful.

However I was thinking more of the assumption that your Sort code[1] + account number can be kept secret, and more importantly the profound risks to your finances if it is not.

[1] http://en.wikipedia.org/wiki/Sort_code
In the original code if out.Close() returns an error, run() will return nil. The revised code sets `err` to the returned error from out.Close(), in case the error from os.Create(*output) is nil.

Simply spoken, the original code will suppress the error from out.Close().
Which, btw., is written in Lisp as:

(incf vx (* ax deltat))

The equivalent of += is INCF.
That's a better story, then. None of the stories that were flagkilled were from BBC.
I recently got a bad review of one of my free WP plugins. The same guy published negative reviews for 3-4 other plugins also in row in the next days. Apparently some people are just mentally disturbed. If you think the emoji issue report was rude, have some fun with these "reviews"

https://wordpress.org/support/topic/everybody-thinks-they-kn...

https://wordpress.org/support/topic/bad-and-misleading?repli...

https://wordpress.org/support/topic/bait-plugin-for-google?r...

https://wordpress.org/support/topic/no-support-weak-plugin?r... (I made the mistake to answer him which resulted in another set of awesomeness).

You just have to develop think skin. I'm still learning this slowly.
1) Step away from the Internet for 2 weeks. Limit yourself to 30 minutes a day for essentials.

2) Get a lot more sleep. Sleep is needed to give your brain time to process and organize.

3) During the two weeks, pick a single book and read it. This will help train your mind to concentrate on one task.

You will feel much better after 2 weeks and will then be in a better position to reevaluate your browsing habits.
I'm guilty of some severe cases of bike shedding bug reports back in my blunder years. Within my small model of reality I couldn't grasp why people wouldn't implement minor feature xy as it would have costed them seemingly only 10 minutes of their time. I appologize to anyone who had to deal with these.
This Is How We Get Ants: Lessons Learned Throwing a Hacker Retreat in Costa Rica
Reptyr – Reparent a running program to a new terminal
It sounds like you should sit down and find the "developer within." That is to say, become technical. Just because a dev is from India/Pakistan/Turkmenistan doesn't mean they're bad developers; that being said, if you don't think they do quality work, either provide a big enough salary that people want to work for you, or learn it yourself.

You say "I could do it myself in one day" but then immediately say you're "non-technical." Sounds a little fishy.
The benefit to set up a deadline
In cases like this, asking users for information, especially for payment details, for a different site than the user is visiting (e.g. PayPal) should be done using separate windows or iframes. Period. Additionally, the specification for visible iframes should make it clear to the user the iframe’s document URL. The iframe itself should have its own non-editable URL address bar, including an interactable area to allow the user to request information about the security details of the framed page for pages requested over SSL/TLS.
Why wait until you're a victim? It's much easier to prevent significant damage to your credit history than it is to repair it. The hassle with credit approvals is pretty minimal; people generally know ahead of time when they'll need a credit check, and it only takes ~15 minutes to put a temporary lift in place. Identity theft is often an expensive, massive headache that can take years to fully recover from.
Remodel – Simple yet Powerful and Extensible ODM for RethinkDB,written in Python
I'm curious now, what kind of guy am I?
Actual misuse isn't enough. There was the case of a woman whose ssn was used by hundreds of people. I think she eventually was able to get a new number but it took years and it's impossible for anyone else.
This seems like something that's going to become more and more of a problem as services attempt to create ever more seamless integrations to create better user experiences.

Has anyone seen anything in a spec or recommendation that addresses a browser-UI solution to verifying the authenticity of iframes or other embedded objects?
Totally agree. Obscurity will not save you from a targeted attack but the main problem on the internet now is automated break-in attempts. Obscurity can be very helpful there. Of course I can't help noticing that this is the moral equivalent of having your group attacked by a bear and saving your life by out-running everybody else in the group.
Basic queuing theory says that if the rate at which issues are opened exceeds the rate at which they are closed (which is easy to do if the project is popular), the number of open issues will grow without bound. The result is that most bugs filed against any popular project can't be acted on. A good UI would help people understand this and set expectations accordingly. It's still very useful to have a database of known limitations and workarounds.
Beautiful. It makes me want to work much harder on mine (https://www.datasnitch.co.uk).

I like the Google/GitHub integration, the API and especially how you sell its simplicity. DataSnitch is quite simple, but you're one step further.

Congratulations :-)
I think this misses the point, if someone doesn't understand open source etiquette then I would give them a friendly reply. Even if it was mentioned somewhere in the documentation, I understand that people can miss it.

It's just that if someone speaks to me in that tone, regardless if this is an open source project or if I'm working customer service for a product, I'll still think they're acting like an ass. It's not a huge deal, people act like asses all the time, but why not just raise the issue in a friendly manner?
Sort code and account number is no risk at all. You can (and many do) quite happily give this information out.
From documentation that library called 'emoji' is limited by some underlying library is not clear. This guy asked to update readme with that. And I really do not feel entitlement or rude tone from there. Perhaps I have different sensitivity level.

Anyway some people spend years working for free, receive death threads, are harassed by governments, have to move to different continent.... All because working on OS. And this is suppose to be THE reason why people burn out?