skysight-inc/HackerNews huggingface dataset:
If you're looking for a discussion community, choose smaller channels/projects and get aquainted with other regulars. If you're looking to learn things and have technical discussions, the trick is not to just find a good channel... It doesn't really work like that. Try to find things you enjoy discussing and have IRSSI ping you when any channel you're in has that discussed.

Don't be afraid to be the guy asking, "How do I get my laptop keyboard controls working in arch." A lot of time great discussion will pop up from people trying to one-up each other in their perfect answer to that and you will either end up learning things you didn't know, or you can correct someone and others will learn from you. Just don't ask anything google can answer like, "what is 0xDECAFBAD in decimal?"

My favorite freenode channels:
#gnu ##crypto ##javascript ##linux #perl #python #android ##math #latex #programming ##electronics
Because they already had a partly-completed heavy launch pad (originally meant for a Zenit-2) there--the only one within Russia proper. It was originally an ICBM base, but it's suitable for polar and Molniya launches. Definitely suboptimal for equatorial trajectories--but it was there and the Russians are nothing if not practical.

They're building a new facility in Vostochny, at a much better latitude, but that'll be a few years yet.
The beauty of the internet is that physical/geographic distance is not the deciding factor any more. Two people far separated by geography can be very close online. So why would an internet-enabled app re-introduce artificial geographic rigidity?
This doesn't take into consideration the time to bring someone up to speed and their productivity hit from that. There is also cost and slowdown from the company's perspective to bring someone new up to speed (it usually will slow down others involved too).

You should just be sure you need and want to hire someone before they show up for their first day.
Pinterest's onboarding process made a few early users its most popular pinners
I don't think it's the fact that docker-the-company is working on these problems, but rather the fact that they're tying everything together very closely, making it hard to use one thing they're working on without the other for no fundamental reason.
Are they trying to deter non-serious students in order to inflate their pass rate?

If they want people to take their certificates seriously, I guess it would be important for people to trust that the person listed actually earned it. The documentation may also improve later conversion to paid products as well avoid the same person passing the course multiple times with multiple AWS accounts to get more AWS credit.
Reciting CLRS is not useful. Knowing why a greedy algorithm like Dijkstra's is optimal can be both beautiful and insightful. A fundamental understanding of these algorithms and data structures only add tools to an engineers arsenal. Of course, code should be the medium through which the interviewee expresses these to make sure she/he is not simply a mathemetician
Many of the largest, busiest applications in the world authenticate passwords with bcrypt. Misplaced concern about its performance implications are as approximately as old as the algorithm itself.

Hardware slices through iterations of fast hash functions --- functions that are designed to be quickly executed on hardware --- like a red-hot knife through warm butter. Developers who think they're getting "fine-grained control" over brute force speed by tinkering with SHA2 are deluding themselves. PBKDF2 is not simply the repeated application of SHA2.

Don't use fast hashes for passwords. Don't design constructions that use fast hashes for passwords. That work has been done for you already: use scrypt, instead of an underspecified, half-functional, and insecure homebrew approximation of scrypt.
A good engineer is adaptive enough to grok and keep the business goals a priority. Developing systems is just an implementation detail.
Tunity-Streams live audio from any TV to your phone
So does every database lookup every application does. The solution to that problem is rate limiting, not (weird that I have to say this) weakening your password authenticators!
I could see this working if say the company said, let's try this out but let's do remote for weekends only. This way I don't have to quit my current job and they can try me out for a while before they hire.
We've found a good middle ground. Giving the candidate a few days to do a test project that involves fixing a bug on the production site. Its something they can do at night after work, gets them resolving a real-life problem, seeing how fast they figure out the codebase.
Quoted:

"In step 4, never tell the user if it was the username or password they got wrong. Always display a generic message like "Invalid username or password." This prevents attackers from enumerating valid usernames without knowing their passwords. "

Completely, utterly wrong. It 'looks' secure. We're not telling the user if it's a login or password.

But if you try to create an account with the username, it tells you "CANNOT CREATE, USER ALREADY EXISTS".

So, it's an anti-pattern that serves to confuse the user but fails to stop a scripted attack.
If you're simply trying to solve the problem of storing passwords, Coda's article is better than this one.
So James Bond is in the public domain in Canada?
All libraries expose an API, which is its set of public functions.
I used to use Python/Pandas for up to 9gb files.
>> I don't fully get it. How come an airplane can recharge its battery in flight?

In a normal plane takeoff is at full power, while cruise is at 75 percent power. So build a smaller engine that can achieve what the big one did at 80 percent and supplement takeoff with the electric motor. Now during cruise you can use the extra 5 percent to recharge the battery. Smaller engine = possibly better efficiency and weight.
The funny thing 5.5 isn't even the current stable version of PHP, which is 5.6. Let alone the whole post is about PHP 7. It's like you're not even paying attention, just doing the whole post for the last phrase.
I have to agree. "will have no choice but to hold Twitter responsible for any damage or loss..." implicates a potential lawsuit if their demands are not met.
I am nearsighted, so I need glasses to see far. Anything over about a foot away starts to get blurry.

But I have a second pair of "computer" glasses--basically, these are de-rated versions of my normal glasses. With these glasses, I can still see about 10-20 feet away but then things get blurry. The theory is because the correction is less severe, these cause less eye strain when I'm looking at a computer all day.
Fast cryptographic hashes like SHA-1/2 are heavily discouraged for password storage (even with a salt). As they are very easy to implement in parallel.

Yes salting prevents as effective brute forcing. Yet modern computing 8 char passwords + salt can be exhausted within 24-48 hours (on a <$20k GPU cluster) if you using SHA-1/2 + salt.

bcrypt/scrypt/PBKDF2 are much harder to brute force (by design) and circumvent this weakness.
Love it! Will consider that. Thanks for the feedback (so many good tips from the HN visitors)
Many planes have a "constant speed propeller", which allows the engine to be kept at its most efficient load, while adjusting the pitch of the propeller. Optimal use of power needed for climbing but otherwise left unused in straight and level flight is a solved problem.
Hitman Pro 3.7.9 Product Key and Serial Number Full Version Free Download
unless you are on a standards committee or are writing a compiler...

Or you work on an existing codebase. Most C++ code that I worked on had templates, exceptions, and used the C preprocessor.

I used to have your attitude. This works for many languages, e.g. if you know some of the syntax of Python or Go and the usual stuff from the standard library, you can get pretty far.

If you want to write modern C++, this is not really true. You need to know about const correctness, lifetimes, some templates, etc. Or you cannot deal with most projects or libraries, like Boost, Eigen, etc.

It's like saying you can program Haskell in 2014 without knowing typeclasses, lenses, GADTs, etc. You can write some educational form of Haskell, sure. But many libraries use these.
Curbi – iOS Parental Controls and Time Limits
To be honest, having experienced the tremendous damage done by poor hires (and the amazing difficulty of getting rid of them once they're identified as such), I might see this as a pretty substantial benefit of working at a company that uses this method. Given that, I might be willing to participate in this kind of interview process. It would probably have to be a company I already know and admire for some reasons up front, but I really want to find a place to work where everybody is pulling their weight.
Thinky, Node.js ORM for RethinkDB and its raison d'être
There's no contact info in your profile. You can email me if you want to chit chat.
But if you try to create an account with the username, it tells you "CANNOT CREATE, USER ALREADY EXISTS".

Then don't do it, give a generic error message and send an email to the accounts email address saying "Did you try to sign-up, you already have an account, here is the reset link in case you forgot the password"
Now Romania Sets Its Sights on Becoming Tech Startup Capital of Europe
It's good to hear that it will be fixed, but it's also troubling that a front-facing security issue took a #1 HN post, followed by debate in the comments before Docker recognized it.
Controlling DNS prefetching
Or you put solar panels on the wings. Solar planes that charge during the day and stay aloft on batteries at night, for aircraft (drones and such) that you want to keep in the air for a long time. Not a new idea: http://en.wikipedia.org/wiki/Electric_aircraft
Wow, marketing fail.

Epidemic information distribution was the center piece of the paper "Epidemic information dissemination in distributed systems" and highlighted in Gossip[1].

Marketing words that have a better connotation for this might be 'discovery' or 'enlightment' or 'intuition', even 'gossip', even though it is often a scourge in middle school, has a better reception than 'plague'.

[1] http://phdopen.mimuw.edu.pl/lato08/notes-1.pdf
10 Names Heating Up the Startup Scene in Phoenix
How David Gregory Lost His Job
Rewards (i.e. Grade/Salary) at the company are based on your perceived knowledge, value and skill within the company. Basically this boils down to the more vocal engineers get better rewards, even if that means taking credit for other peoples work.

I believe the issue boils down to management having no true idea of what everyone is doing, so believes the general targeted noise coming out of the work force from select members. You then end up with a lot of people jumping up and down saying 'pick me, pick me...' because they want to be the noise that's noticed.
Why can't the website tell what it actually does? It's honestly a terrible landing page for an app.
I take care of vision like I do the rest of me - with reasonable precautions. Sure, there is eyestrain, but is it any worse than people that used to stay up into the night reading by the fireside? Probably not. Take blink breaks. Stretch while you are at it, doesn't take more than a minute or two a few times an hour. Nothing complicated, definitely doable. Once you have that habit, it is easier to expand so that it is second nature even when you are busy. Don't worry so much about the sometimes if your general work habit is healthy, unless those sometimes happen with some regularity.

In addition, if you find you have signs of eye strain (headaches, among others), get your vision checked. Even a small irregularity can cause eye strain and this is a simple fix.
If you server cannot hash incoming authentication attempts properly with bcrypt or scrypt, then the solution is to upgrade the server, not weaken your authentication to compensate.
Well said.

We're not doing helpareporter.com anymore for now (might later). The right publicity to the right market can work well, but this isn't focused enough for us yet. There's bottom of funnel work we can do better for now.

We got signups from the HN traffic. I totally understand that HN traffic doesn't covert in some cases - it's not been insane conversions for us, but it's working. That wasn't my goal from the post (I've never published to medium / haven't been active on HN), but cool surprise.
Tingling Feeling
Sending an email to the registered account is not a solution, because that doesn't tell the registering user that the username is unavailable.
Wow. That's a fun one.

It's also a perfect example of why even really amazing teams reinventing a language/tooling ecosystem from scratch stumble over problems that were solved years (or even decades ago) in preceding platforms. I leave it as an exercise for the reader to decide if the "reinvent from scratch" critique is more deserved by Docker, Go, or Linux.

That being said, I'm pretty sure even the broken Setuid behavior described there would be good enough to sandbox a thread or child proc that was just handling buffered I/O into and out of the xz binary.
https://securityblog.redhat.com/2014/12/18/before-you-initia...

I think RH has also posted this just for the attention.
This is only for the 'verified' track only it seems, it seems they are trying to verify that the actual person who signs up is the one taking the tests.
Engineering with lawyers...
Were you to do some spelunking you'd probably find http://goo.gl/vZdTyh (sorry for being oblique about it :)
Tangent:

Salts do zero to mitigate brute-force attacks.

Salts defend against one idiosyncratic lookup-table attack that was briefly popular in the early 2000s because of a widely-deployed password hash function that, unlike every password hash since the mid-1970s, didn't randomize. This is the attack to which "rainbow tables" are applied.

If you're considering rainbow tables as part of your threat model, you're already so boned that you should give up and just use a real password hash. If you're not considering rainbow tables, you don't have to consider salts.

The only good thing about "strong salts" is that they function as a kind of shibboleth so you can tell if people understand what problems they're contending with when storing passwords.
As much as I like Rust, it is in its infancy and it will be years before it gains similar traction, if it ever does. The other languages you mentioned are not in the same category (garbage collection alone excludes them).
A mod or the OP must have fixed it (it originally said "treathens").
fairly certain bridging works fine, though it does not support bridging to a teamed interface for some reason (though it can be manually setup)
I love Plague.

For me, it's like the spiritual, mobile successor to mainpage reddit, i.e., a nice casual way to consume & share neat photos, links, and interesting "what if...?" questions.

So far at least, the community has been very positive, and not overrun with 9gag-style inanity.

An interesting aspect of the dissemination scheme is that even popular cards will only spread to, say, 100 to 1000 people. This keeps the conversations on the cards small enough to still be intimate.
Will check out the podcast and the book - Thanks for sharing!
iterating over the file, incrementing the key/values as they occur

Isn't that exactly what the Hadoop job would have to do anyway? The whole point of Hadoop is to process the data in a single pass, which is what your method does. As long as you iterate over the file without reading the whole thing into memory first.
You and me both brother. *highfive

Forced interaction with a social network is an easy way to alienate anyone over 15.
People on Pinterest feel like they are alone for some reason. I argue that this is good for creativity in a paper here: http://ecologylab.net/research/publications/everyday_ideatio... http://dl.acm.org/citation.cfm?id=2557273
I think turboprops have lot of space for improvements. They are limited by materials and cost.
Reading the same address in an infinite loop is quite common in the multi-die/core real time low latency systems. In fact this is exactly what you are doing - when reading the FIFO queue pointers, etc. And rather than relying on QPI/cache coherency, you may even want to forcefully flush the cache every time you read, to reduce the latency.....
The thing is that most of the things that your parent mentions are not just some theory. Exceptions, templates, and the C preprocessor are used in most real-life C++ code.

I think starting from somewhere with modern C++ means not starting at C strings, arrays, and bare pointers but starting with STL containers, STL algorithms, and smart pointers etc. to build good habits. But eventually any good introduction has to cover C arrays etc. as well.

Back when I started C++, Accelerated C++ was that sort of introduction. But AFAIK it's not updated for C++ 11 or 14.
The point is, if you want to get an actual job in the actual tech economy -- not the ideal tech economy from your head -- better bone up on your brain teasers. And have a Word-format CV.
No, this is for verified certificates. You can audit (and get graded) for free anonymously.
Unless there is a unique piece of information and it is physically taken away, it cannot be stolen, only copied?
If a username isn't obtainable, it would be fair to assume the username is in use.

I know of no situations that seed "unobtainable usernames" in a DB. Although now, I would expect that.
Cladistically, apes are monkeys.
In that case, just as an interviewer looks for indications beyond a single question, so should an interviewee. Cutting an interview short because of one indicator seems short-sighted. Surely better
would be to use it as one indicator, and then start looking to see if there are more.

But I understand the point point of view, I'm just trying to give some balance, and point out that the black/white attitude this suggests is sometimes a clear indication that you are not cut out for a particular position.
From the link:

ITERATIONS = 600
...
crypto.pbkdf2 pwd, salt, ITERATIONS, LEN, (err, hash) ->

That's way too small for the number of iterations. Something like 100K would be a better choice.

Alternatively here's a version that uses bcrypt:

bcrypt = require 'bcrypt'
rounds = Number(process.env.BCRYPT_ROUNDS || 12)

module.exports =
hash: (password, cb) ->
bcrypt.hash password, rounds, cb

compare: (password, hashedPassword, cb) ->
bcrypt.compare password, hashedPassword, cb
Sure but it seems strange way to discuss it. Unless it's an API that wraps some existing library.
Security margins here (IE: bcrypt versus SHA-2) are estimated with entropy, which is also completely missing in the article. A weak password is a weak password, bcrypt or not. If there is sufficient entropy behind the password, 500,000 rotations of SHA-512 is not "weaker" than bcrypt, Only faster. You should know this (weird that I had to say that).
You would probably also get the opposite problem: I bet some people (particularly international candidates) have little to no experience with Monopoly, and the question would be unfair to them. If the goal is to start with their vague understanding of the game and see what gaps they fill in and what assumptions they make, then it doesn't work very well if you have to explain the game from scratch. It also takes quite a bit of time to explain the game if someone hasn't seen it before, which doesn't feel like a very efficient use of interview time.
If you're using Rails (or ActiveRecord/ActiveModel specifically), you should probably skip the suggested Ruby example and just use has_secure_password. It's built in, uses bcrypt, and greatly reduces the likelihood of making mistakes in a custom implementation.
Are you offering to upgrade my hardware infrastructure for me?
Programming JavaScript Applications – free ebook
Unbury․us – get unburied from debt
A (maybe unrelated) question about companies like Google and Faceook, which are C++ powerhouses: how many (if any) of the C++11 or C++14 features have they approved for use in production code?
What if both the hiring company and the applicant have lives on the weekend?
They are correct, it is important to show a generic message on the login. The login is the first place an attacker will look for user enumeration. Just because you may be able to find user enumeration somewhere else doesn't mean you should leave it open everywhere.

For user enumeration on registration you have two choices:

1. Provide a unique registration link to an email for signup. The prospective user goes to the registration page, submits and email, checks their email, then follows the link to a registration page. On this page it's easy to see if someone is enumerating usernames, and every request contains the token from their unique signup link so the token can be invalidated quickly.

2. Provide a slow rate limited lookup to verify an existing username, every 2-3 seconds, which shouldn't negatively affect users as they signup because they have to fill out a registration form in the mean time. This will however greatly slow down a bot.
Cipro did wonders on my intestinal tract, effectively killing everything including the good. Had nine days of that to fight an under the skin infection/etc. Months after I started having problems with food, restrooms were becoming my second home and my commute was planned around easy access to them. You never want to experience life where one bit of food can send you off.

Six doctor visits, stool and blood tests later, the doctors found what moved in. New antibiotics and replenishment medicines, diet with lots of probiotics, and within a few months I was back to mostly normal.

My story is simple, if you end up on harsh antibiotics it can change your life. Plan for it.
I've never had to do that for an edX course but then I've never paid for a verified certificate. It sounds as if they're using the verified certificate machinery here--which makes some sense given that you're receiving material AWS credit for successful completion.

(FYI, AWS gives $100 credits quite readily for on-line course takers in general.)
I'm not sure if you know how to read:

dev@aerilon ~/dev $ hhvm memusage.php
2 MBs [2097152 bytes]

That is using the same benchmark that nikic is using, and it's using half the RAM of her PHP 7 example.

Please try and be less apologistic and use some reading comprehension. It makes you look more intelligent and puts less stress on other people to accommodate your intellectual laziness.
Great questions! Sorry for delay in responding (been hectic last 24 hours)

The value of what we do seems to be that we're available for the visitor, we do our best to help (fast response, personable, etc.), etc. And if we don't know the answer, we commit to getting them in touch with the right person on your team (i.e. a lead for you, and a happy visitor).

We go through a detailed on boarding process to get the info we need. We study the ins and outs of your site, and also ask questions as needed before starting the chat service.

If we don't know the answer to a question, we are honest with the visitor (visitors appreciate transparency rather than halfway answers - i.e. like a cox.net, ATT, Verizon, or other similar website chat team). We then offer to connect them with someone on your team via email to get an answer asap.

I know this sounds simplistic, but it's working well.

I'm going to put together a case study on the site, and possibly deeper blog post about tackling this part of the problem, as it's a THE QUESTION so far. If you want to check it out, drop your email on the site (there's a "follow our progress" button on the blog posts).

Thanks for the feedback!
Before you initiate a “docker pull”
got my first real exposure on NetworkManager/nmcli this past week doing some redhat 7 stuff. it turns out that it works quite well. For automation stuff, it definitely beats trying to sed a bunch of ifcfg- files. havent really touched the gui though.