skysight-inc/HackerNews huggingface dataset:
Since the page itself is useless: this is like Tinder for reddit's r/funny subreddit.

No account creation, so it's probably just tied to your device - sort of like Yik Yak, I guess. Things seem to be geographically correlated, though I imagine that the more 'viral' a thing is, presumably the further it can spread.

edit: I guess you can create an account, but it's not required to 'infect' crap.

At least here in NYC, it seems like one user is generating 99% of all content. A third of it is "art", a third of it is gifs of girls twerking, and another third is just celebrity snapshots.
Unless you define merit as selling.
When I have a dictionary of dictionaries, I want them in a particular order.
Which part was criminal?

Various employees have started civil suits claiming damages.

Their entire IT infrastructure was obliterated and they had to spend tons of money on IR and new security tools. So quite a bit of damage has been done already.
According to the FAQ:

Whatever Account # you provide to edX is the one that will be associated with the credit.
I highly recommend that book as well, I learned more about signal integrity from reading it twice than I did during all of EE undergrad.

Link: http://www.amazon.com/High-Speed-Digital-Design-Handbook/dp/...
The fact that we're still talking about password hashing shows how much we're losing the war on security. Whether or not a service stores passwords correctly cannot be verified by the user. There is no up-front cost to storing passwords incorrectly, so sites have inadequate incentive to store their passwords safely. As such users must use different passwords for every site. This simply is too technical an issue for most users: no amount of education will fix this, and password managers are too much work for most users. The end result is that even if you hash your passwords correctly, your user's passwords will be compromised on other systems and this will lead to accounts on your system being compromised.

The solution to this is zero-knowledge password proofs[1]. Essentially, you should never be passing your password to another party. Instead, you should be providing the authenticating party with a prover (analogous to a public key in asymmetric-key encryption, but based off your password) when you sign up. Then when you want to authenticate, you provide the server with a proof based off your password which exposes no information about your password but can be used to verify that you have your password using the prover (analogous to a signature in asymmetric-key encryption, but again based off your password). There are a number of ways to generate these provers and proofs using existing asymmetric-key algorithms such as RSA, ElGamal, or ECDSA.

Once this becomes pervasive, browsers and other network applications can provide obnoxious security warnings similar to those currently provided for untrusted certificates. This will create an up-front cost for people still using password hashing and shame them into moving to ZKPP, while providing a user-friendly way for users to tell if their password is being used insecurely. Only once people are no longer giving their passwords to anyone with a login page can we be sure that poor security on other sites won't compromise our own servers.

EDIT: Additionally, ZKPP mitigates some of the damage caused by man-in-the-middle attacks. Currently, if an attacker can gain access to communications between a user and server, they can access the password in plaintext when it is passing over the wire, even if it is adequately hashed on the server. This has both permanence (the password continues to be useful after the vulnerability is discovered--until the user changes their password) and wide application (the password can be used on multiple sites).

With ZKPP the attacker only has access to the proof of the password. This might allow the attacker to authenticate with the server during the attack. However, a proper ZKPP implementation uses unique nonces from the server to create the proofs and rejects non-unique proofs, so the proof cannot be used after the vulnerability has been fixed (the server will check that it is unique) and it cannot be used on other sites (the nonce is provided by the server).

[1] http://en.wikipedia.org/wiki/Zero-knowledge_password_proof
The vast majority of humanity still depends on domesticated animals for labor and food. Goats are very commonly used to convert inedible wild plants into human ingestible calories in impoverished regions who do not have modern factory farming infrastructure.

Certainly we can find other philosophical approaches which are more reasonable.
I think you have a good point, but it is worth noting that being unable to communicate effectively significantly reduces your ability to change the world around you in a meaningful way. If you only have a few words for colors, then you're going to have a hard time exercising fine control over color-based problems.

However, one should also remember that language isn't just words. You can refer to colors by motion (pointing at a chart) or by proxy (using a code like #34F278). So we are limited by our language, but our language is not so limited as to make us fools for not having a word or two.
> The fact that we're still talking about password hashing shows how much we're losing the war on security.

This post was written years ago.

> Whether or not a service stores passwords correctly cannot be verified by the user, and as such users must use different passwords for every site.

Actually, in PHP applications, if passwords are stored plaintext or via unsalted MD5/SHA1 and are compared with the non-strict == operator, we can test it remotely.

https://eval.in/108854

Granted, this is technically exploiting a security vulnerability, but it's pretty conclusive if it works. :)

As for ZKPPs, I'm looking forward to SQRL for anonymous, Ed25519 challenge-response based authentication that takes place without requiring technical knowledge, personally.
I am not ignoring the issue, I am advocating the more secure system configuration. I know that it is expensive, and it can introduce additional performance requirements. When choosing to implement proper password hashing or not there is a tradeoff. That is a decision that needs to be made on a case by case basis.

None of that changes the fact that the _more secure_ thing to do is implement bcrypt/scrpt/PBKDF2. I bet there are plenty of people at Sony, Target, Adobe, Home Depot, Staples, etc. that wished they had taken the more secure route and spent that extra money.
If 2001-2002 is old, then what is 'used for 7 years starting 1994'?! :)

I will be curious to read the replies here, as a year ago I was considering different languages and environments for a cross-platform project, and ultimately C# (yes, C#) won out over C++. To be fair the requirements for the project meant that runtime performance wasn't so critical, but preventing the developer - myself! - from making mistakes was.

Maybe it is because of my age, but despite having lots of experience with C++ and a mostly pleasurable love-sometimes hate attitude towards it, I couldn't imagine it making first choice for me these days for new projects.
A year ago, I would have agreed (that templating is cleaner, better separation, and going back to generating HTML from code would be a step backwards). Since I have been using React.js, my opinion has changed 100% -- and I realized that the supposed "separation of concerns" that drove us to template languages in the first place was an arbitrary separation. Separating components (a button, a form, a site header, what have you) is the kind of separation you want, not separating languages arbitrarily. If you look at the evolution of template languages, they sometimes start simple, but all of them have added sufficient logic to approach or surpass turing-completeness -- it turns out that you want to write templates with logic in them, that that is actually how you separate concerns effectively. The logic and rendered markup for a particular component should be cohesive; components should be loosely coupled together.
Then this is even more dumb than imaginable before. You shipped a broken feature, with an inaccurate message that gives a false sense of security and didn't bother putting it behind a flag, at the very least?
> obviously we disagree! i think it's ok to miss out on language features.

Sure, but there are a ridiculous number of edge cases which result in undefined behavior -- this is something that cannot be avoided when learning C++. You really need to understand what undefined behavior means and what precautions you need to take to avoid it. (Don't get me wrong, recent standards let you write code that's a lot less likely to run into UB, but you need to learn that from somewhere. You should definitely not be approaching modern C++ as an improved C!)
Phone Turns into PC with AWESOME UI
Transarctic mountains underneath..that's pretty dope
I know that antibiotics are a significant factor in the loss of gut bacteria, but another factor is all of the preservatives that pervade the manufactured food most people eat every day. I've often wondered what percentage of the loss is from these substances.
>There are times when geographic locality is the thing you want to filter on.

Which has nothing to do with actually being near said locality. I think filtering on geographic locations is great, but even greater is that ability to do so while remote. I can learn about events occurring in and around a specific area without actually being in that area. That's (part of) the beauty of the internet.
Plague Inc. of real data! Cool!
The first quote is in reference to the announcement. The second quote refers to the CLI messaging. Shykes is acknowledging the problem.
All Startup Names Are 8 Letters
What is the cost of a Verified Certificate for this course?

According to the pricing section of the Verified Certificate page, the minimum fee varies by course but I can't find a way to determine the minimum fee without an account.
Am I the only one not finding how much the verified certificate cost? It says that it has a minimum fee, but it doesn't say how much it is
I really advise caution with using 'docker load'. It's more susceptible to malicious input than 'docker pull' is. That said, it has a stronger trust story. Lets not confuse the two. If you know without a doubt that your image and all of its layers are safe, then you can use GPG to do image signing and verifications, then load the image into docker.

That assumes that what you're signing and verifying is safe, i.e. non-malicious. Again, 'docker load' is less protected against malicious inputs, so under no circumstance is it safer to load arbitrary, untrusted content through this mechanism.

Finally, an interesting middle-ground is to containerize the 'docker pull', then use Docker itself to generate sanitized input to 'docker load'. It's not perfect, there are still ways to attack it, but I did put together a PoC of this:

$ docker run ewindisch/docker-pull ubuntu | docker load
The solution doesn't takes into consideration the 'fizzbuzz' output. Your solution would print both fizz and buzz when the int is divisible by both 3 and 5.
Another "everybody uses social media as much as we do" failure.

I'd rather not give over my credentials to anybody.
Their email sync is definitely superior to Google Apps, and now that they're adding DAV support the only thing really holding me back from switching my personal domain email over to Fastmail is email tagging. Gmail is, as far as I can tell, the only show in town for having email tags that sync across the server and client (unless you're in Exchange, but that's suboptimal for my personal use), and that's how I do pseudo-GTD to keep track of actions in my email.

Edit: I have a secondary email account through Fastmail where I don't need the tagging ability, and have been very pleased with the service. If you don't need tagging, I think it's worth the switch. They're clearly active in improving the service, while Gmail feels like it's moribund.
withr regards to point 5, you should look at bittorrent inside i2p[1]

1: https://geti2p.net/en/docs/applications/bittorrent
The airline industry is essentially beholden to the price of fuel, right? If an airline figures out how to not need so much fuel, they could undercut and make a larger profit than everyone else.

Is there work on hybrid or electric passenger flight? Will there be?
There is a book called "Seeing like a state" http://www.amazon.com/Seeing-like-State-Certain-Condition/dp...

In it, the author tells a story of someone in a village in a less developed country who cannot afford pesticides. So he starts a war between two ant colonies in order to drive out the ants that are destroying a beloved fruit tree.

You can do the same thing for gut flora. You don't have to wipe things out first. Trying to wipe the gut clean is extremely hard on the body. It's much easier on the body to just feed the good flora and give them support so they start crowding out things you don't want. It's a gentler path. It just takes persistence.
There is no reason to suppose this.

My wife eats salads all the time at home and packs them for lunch, but whenever we go to a fast food joint, she orders the Big Mac and fries specifically because she doesn't eat them at home and doesn't feel like eating healthy. (That's why we got fast food in the first place)

Fun Fact: two slices of digiorno pepperoni (1/3 of the pizza) is still only 640 calories. So even if this person does cook a frozen pizza at home, it would still be a lot healthier. An egg omelet with coffee, a salad for lunch plus some fruit, and two slices of pizza plus some cookies for dinner would be approximately 2,000 calories.
Pebble Emulator at the QEMU Advent Calendar
Do other countries with less draconian copyright laws gain an advantage?
https://www.edx.org/AWS-activate is the source and it's a minimum $50 contribution for the requisite "verified" certificate.
Sony to Show ‘The Interview’ in Theaters After All
You shouldn't have to login to create a new item.
A similar project, NameID[1] has been around for a while. The fact that names on Namecoin expire may make it unsuitable for some applications, though.

1. https://nameid.org/
So, yes, it seems that James Bond has entered the public domain in Canada. I wonder, though, what kind of legal hammers would be brought down upon someone who tried to do any sort of adaptation or reproduction of the work in another medium. Could an animated adaptation of the novels (or even just an illustrated version) be made, and if so, what limitations would be in place (or what legal ramifications would need to be considered) given that in the US this material is NOT in the public domain, and would at least require licensing (I assume) to be distributed in the US?

It's Public Domain, but not really? :P (I'm from Canada, and I'd love to explore using some of these works creatively, but it's tough to unravel what is and isn't kosher).
> There is nothing particularly new in Jonathan's post and I thank him for facilitating a conversation.

Maybe not new to you or Docker Inc staff, but I don't see any warnings that a pull could result in complete compromise. On top of this, the inaccurate "verified" image message is still in the current release.

> I have explicitly called out the need for containerization of the 'xz' process, and to run it in an unprivileged context.

Do you have a link to this?

> As this work comes out of review and a specification is finalized, we should expect to see a much better experience and more secure image transport

Is there a draft specification available for libtrust?

> However, as the libtrust and v2 image work, and subsequently, registry protocols are still in draft and security review, it is difficult for us to recommend that users yet attempt deploying these.

And yet you deployed it to production in 1.3.
How to Style a Long Cardigan
Handy link from the article if you want to be a bit pickier about the eggs you buy: http://www.cornucopia.org/organic-egg-scorecard/
Ask me which I'd trust more: a website that stores passwords using whatever hash a PHP developer came up with, or a website that implemented some kind of PAKE, like SRP, to authenticate passwords.

What's especially ironic about your comment is that password-authenticated key exchanges still require servers to store authenticators which can be attacked offline. PAKEs actually make the problem we're talking about harder, not easier, because the authenticator format has to be compatible with the protocol.
Does C++ not deduplicate templates that work on the same size types? E.g. if I used std::sort on arrays of `int`, `unsigned`, `float`, and half a dozen structs of exactly 4 bytes, I don't see why there would need to be more than one copy of the template in the final binary.
A Unit Is Not Always a Method or Class
Thanks guys for all the feedback. Didn't want associate this with a specific comment but here is what we're hearing:

* Look at how to make this a risk free opportunity, money back guarantee, etc.

* Play with pricing, percentage of amount saved vs flat fee. Our biggest worry with that is trying to get someone to pay later on. As right now we aren't rebooking it, if we sent you an alert "go rebook on XYZ.com and save 500 bucks" we have no way to force you to rebook or verify if you actually got the deal we found.

We'll definitely be taking in all the feedback here and hopefully trying to work it all into the next version of this.
I'm not convinced that questions like these work effectively at all. They might give you some insight into a developer's ability to research and implement some specific algorithms (because you're not making them do it on a whiteboard, are you?) but there's a lot more to being an effective engineer than that.

We've had success with a two-hour pairing exercise, in which the goal is "build a miniature version of one of the core parts of our product" with one of our engineers. That's followed by explaining the goals, technology, general approach etc. to another engineer, then a discussion about what would happen next, some of the specific domain problems, that sort of thing. There's no expectation that the project is completed in the time available, and it's more about understanding the process.

This has been pretty effective, and is great for getting a more rounded understanding of the skills of a particular engineer. In my experience, rather softer skills like the ability to clearly articulate the problem, to understand the broader impact on a bigger system, and to be able to identify future issues and challenges are more important than the ability to solve specific technical challenges. Lackluster technical ability is usually pretty immediately obvious when pairing with a developer, in any case.
One wonders if this has already been used in a exploit.

A good first check for security companies - examine all known attacks for fence instructions, which are rare. (Without a fence instruction, hammering on the same addresses will just cycle the caches, and not go out to DRAM.) Look at the code near them for a hammering loop.

This is a promising attack, because it might be able to break through a virtual machine boundary.

A test for this should be shipped with major Linux distros, and run during install. When someone like Amazon, Rackspace, or Google sends back a few thousand machines as rejects, this will get fixed.
This is kind of reinventing the wheel. If I want to hear things from people in my area, why can't I just walk outside and talk to them instead of using this app?
Chromebook gets 'OK Google' and other Android features
Great advice on weeding out the ones we won't be able to find savings early so we don't waste time!

Rebooking is on the roadmap just wanted to get the first version out and see if there was interest in this type of product.
Heh, is Chrome slowing down the Javascript clock when you switch away from the tab? Because it changes to around 1 beat per second.
There's no such word as "apologistic" (really, look in the worduary, which should be available in your local bookery).

And the result shows PHP 7 reduced memory usage by hashtables threefold since 5.5. Yes, this is pretty good. No reason to be bitter or sarcastic.
Those aren't data races. Page faults are actually synchronized (they block) and the switch to kernel mode is a synchronization point. They are examples of races, but they're not examples of data races.

Just to be completely clear, since we didn't define what we were talking about: a data race exists when there are two or more unsynchronized accesses to the same memory location, at least one of which is a write. What happens when that occurs is undefined behavior in C, whether or not you are writing a kernel. On some hardware the result is totally unusable (the write is corrupted). Additionally, the compiler and (on some architectures) the processor are free to reorder operations such that other threads will see your writes in the wrong order, or not at all.

This is all hardware level, the kernel has to deal with these problems too. The "relaxed" ordering in the C++11 memory model is essentially the lowest guarantee you can do anything useful with (other than have something like a racy counter, where you literally don't care at all what the value is, which is basically the only place the kernel has intentional data races at all). For some architectures and operations it resolves to a noop (relaxed stores and loads on x86, for example, never require additional synchronization beyond what the compiler provides).

The Linux kernel takes advantage of these semantics for lock-free or mostly-lock-free algorithms like RCU. There's a lot of code in those implementations specifically to ensure the correct barriers and orderings are in place so that there can't be data races. There's no reason they couldn't be implemented in Rust, and it would probably be easier since they could rely on LLVM's implementation of fences and so on rather than reimplementing it for each architecture. And if LLVM didn't have what they needed, they could just implement it in inline assembly (which is what kernel developers already do anyway).
MySQL for bcrypt and/or scrypt.
24 days of Rust – calling Rust from other languages
After plenty of clicking around after logging in I found this page:

https://courses.edx.org/course_modes/choose/MITx/15.390.1x/3...

Which indicates the minimum fee is a $50 contribution.

It feels like edX could do much better in making that pricing information available before enrolling but perhaps their testing has indicated otherwise.
Right, I meant "pulling their weight" in a relative sense, with the understanding that a more experienced and talented employee will do more work or do it more quickly. Maybe my desire is simply to increase the proportion of coworkers who make roughly appropriate contributions to the team effort. I once had to explain how splines worked to a graphics programmer with 20 years of industry experience.

A trial process like this would select against lots of quality developers, true, but that isn't the real question. Instead, I want to know whether the developers who wind up being hired represent a more talented subset. I can't prove that it would, but I feel that this system would be more accurate in letting the right people through.

All that said, I like some of the gray area solutions proposed in this HN thread, including after-hours or weekend remote work on a project already in production. Not a perfect solution, given the inability to evaluate things like culture fit, but it combines many upsides of the alternatives.
Haha yep. Chrome cranks SetInterval way down when a tab is in the background.
This is how companies like google, facebook, and linkedin interview candidates. It's not effective, but it's the common practice
I'd agree, although refine your criticism further: it's not so much a tautology as that "success in SV" selects for "people who appeal to VCs" which may or may not have anything to do with any other forms of merit (like the intelligence or technical merit people love to claim as being the underpinnings of "meritocracy".