skysight-inc/HackerNews huggingface dataset:
Because localities don't make money on accessibility, they make money on property and commercial taxes, which encourages build-out and real estate development of anything that's left untouched.

Better accessibility (and higher density) would also mean a leaner city services staff needed to service it all, so it's understandable a municipal bureaucracy is not going to be the prime advocate of that.
Starbucks.com isn't https and asks for credit card # to retrieve payment history
He then makes the same offer for your kids.
Kalle Anka provides a excellent time where the parents can take a break after eating the Christmas dinner, drink coffee, and prepare for the event of delivering and opening presents with the children. A break, where everyone is expected lean back, to sit still and be calm.
I can certainly imagine why they would love their unions. They are great for the people, but shit for our states economy. Unfortunately, they have such lobby power it's tough to stop them here.
Came here to say basically this. Well stated, far better than I could have said it myself.
You're about to give it up to Red Hat, with systemd taking over everything, whether that's your cup of tea or not, that's what's going to happen.
天龙八部最经典的一个版本，我前段时间又重新看了一篇，送给你： http://www.youku.com/show_page/id_zcbfb7d48962411de83b1.html
Tellingly, the FBI's press release says that the bureau's conclusion is only based "in part" on these clues. This leaves open the possibility that the government has classified evidence that North Korea is behind the attack.

I am surprised that the article doesn't end here. Other press reports have highlighted that there is classified evidence that has not been disclosed, and it seems odd to me that Schneier would play this aspect down in a story involving cyberattacks, North Korea, the FBI and the US intelligence community.
All of our doctors contact us through email. I think they use Epic, and we get all of our test results, appointment reminders, etc. there. With health care regulations forcing electronic records, we'll probably see more of this.
It can also depend on how many developers will write with your framework, and how long your code is expected to live.

If the code is built on a custom in-house framework, you are putting the burden on everybody to learn it and understand it and hope they can see it the way that you can. No one will really be as invested as you in understanding the ins and outs of the framework, or the special features you added that they won't even think is available, and won't care to discover or ask about.

With a well known popular framework, not only is it likely to have more documentation available online, there will be more resources from other people blogging about solutions, workarounds, tips and tricks. There will be additional libraries built on top of the framework for common problems. There is the incentive that getting good with the framework can help them in their next project or their next job interview. Lastly, it also reduces the friction of adding new team members.
If you've been watching Pope Francis lately, it's providing a strong contrast against fundamentalism, which he has even decried as a disease in the church that needs to end.
3) Sermon.
I'm dismayed that this piece is repeating Marc Rogers's gross misportrayal of the linguistic situation of the Koreas, saying that "Korean language in the code also suggests a Korean origin, though not necessarily a North Korean one, since North Koreans use a unique dialect." First of all, North Korean doesn't have "a unique dialect" but a number of regional dialects, just like South Korea, and like the situation in many languages. But again as in many major languages, a supra-regional, standard Korean language came into being, based on the central dialect region around Seoul which was the capital for many centuries. Before that the capital was Kaesong, which is in the same central dialect region as Seoul though it is now in North Korea. This happened before the division of the peninsula. Even today, the standard Korean taught and spoken in North Korea is based on this common standard with the South. The differences between regional dialects within either North or South Korea are far greater than the difference between the standard Korean spoken in the North and the South. The difference is mainly in words (especially any technology-related vocabulary introduced after the end of WWII) and spelling, and it's a lot like the differences between British and American English. You're never going to say that something written in English can't have been written by Americans because they have a unique dialect.

Also, as far as I know the codes didn't contain any Korean. Instead, what they found was that it seems to have used Korean text encoding, like EUC-KR. People have pointed out that this is a South Korean encoding, but North Koreans also use it since you hardly find any software that supports the official North Korean encoding. Again, if someone uses a British English locale, that isn't proof that it can't be an American. When it comes to text encoding and locale, you usually use whatever is available that lets you type in your own language.
I'm pretty sure it's more like 35+ years. Soviet Union has been gone for 23 years now.

It's a Soviet love story where a guy gets so drunk with his buddies that he ends up getting on the plane instead of his friend and goes to another city. Wakes up in the airport, calls a cab, gives him his street address and is dropped off at an identical street with identical apartment building and opens the door with his key, to someone else's apartment.

Unless you lived during those times, it's hard to understand how everything could be nearly identical, but the equality of that was a key soviet ideal. The movie pokes fun at how ridiculous that really is, but at the same time has a love story form in those conditions.

I doubt that narrative would have been allowed even a decade earlier.
I still think the burden of spam prevention should be on the person who developed/maintains the website. Putting that burden on the end user not only annoys people, but if a person can solve it apparently a bot will solve it eventually so its only a temporary solution.
Good point, it's New Year's Eve, not Christmas.
I agree; this was a pretty disappointing article. It doesn't add much information beyond just the bare fact of pointing out that the Mincome experiment took place, colored with some anecdotes. Even the short Wikipedia article is more informative: https://en.wikipedia.org/wiki/Mincome
Ask HN: Is worth learning Ruby on Rails now a days?
I was wondering if is worth learn Ruby on Rails now a days because there're other technologies like Node.js, Scala and Go which I think are better than Ruby for web development. This comes because I never learned Ruby on Rails, and I saw the Mackenzie Child post on Medium (ICYMI: http://goo.gl/dFfflh), but don't misunderstood me, I think is a great idea and he provides awesome value to the newcomers who want to learn Rails. I'm already a Node.js developer, I use Express and even Sails.js, which I think is a great framework for fast prototyping. But, if I already know Node.js, Is worth learn Rails at this stage?
And guessing the tinfoil conspiracy about Sony hacking itself wouldn't stay secret long. :)

My thought is we'll probably never know for certain unless perps reveal themselves, so saying NK definitely did it would be jumping to conclusions.

The real story is: Best. Marketing. Ever. And an international incident, to boot! (Well played, Sony. Even Obama was part of the story.). Seriously, the canceling the release was the story-making move. And the subsequent nonrelease release monetizes the situation. Couldn't have planned it any better. ;)
Wow, this is really bad.

With all the discussions revolving around the more advanced side of SSL for non PII something like this, which violates PCI and other requirements, simply goes unnoticed.

I wonder if the person deploying this warned the company and the higher ups just ignoring him/her...
This seems to come up now and again, so there is actually many articles about this topic floating around. Wikipedia has a pretty good overview [1, 2], for something little more in-depth check out the University of Manitoba's TOWN WITH NO POVERTY report [3], even Al Jazeera actually has a nice piece with interview from several recipients [4]. If you search Google there is countless good pieces about this experiment [5, 6, ..].

[1] http://en.wikipedia.org/wiki/Guaranteed_Annual_Income

[2] http://en.wikipedia.org/wiki/Mincome

[3] http://public.econ.duke.edu/~erw/197/forget-cea%20%282%29.pd...

[4] http://america.aljazeera.com/articles/2014/8/26/dauphin-cana...

[5] http://www.cbc.ca/news/canada/manitoba/1970s-manitoba-povert...

[6] http://www.winnipegfreepress.com/opinion/columnists/dauphins...
Secret evidence can be used to justify whatever whims the gatekeepers of that evidence wish to pursue politically.

If anything should be learned from the Iraq debacle, it's that.
I work with PHP. My suspicion is that it's the the Java of the day. I remember a lot of crap being heaped onto Java 15 years ago and now it's PHP's turn to sit on the seat of scorn.

I feel like PHP is just a very dull work horse with a lot of legacy code devs have to churn through. It doesn't really do anything new or sexy. It kind of globs features from other popular languages long after those features have been tried and tested.
Sure, but that doesn't mean the GP has time to deal with those properly.

I maintain a fairly small time open source package, and generally the users aren't super savvy in terms of coding, I understand that. It's an R package, and most of my questions I receive are really basic R questions, not about my software. C'est la vie.

But while I understand that doesn't mean I have time to deal with it much anymore. Responses tend to come in large batches once every couple of months just because that's when I'll finally get a chance to devote a decent block of time to the thing. OTOH if I get a non-horrible PR I handle it relatively quickly. To your point, a well thought out issue is appreciated by me, but it's just not going to get handle anywhere near as fast as a PR - that's not a judgement on the submitter, just a reality of free time
Nicholas Humphrey – What Shall We Tell the Children? (1998) [pdf]
You are quite right about the reason for carriage laws. They're right out of two centuries ago, where a person who got into a conveyance had no idea what they might be getting into.

Those days are long gone, however. Today I can buy a used car on Ebay, committing thousands of dollars to a sale for a product I've never seen and a seller I'll never meet, all without worrying about the transaction. Why? Because information flows much more freely. The commercial transaction that used to take a government guarantee now just requires an open exchange of information about past history -- which is trivial to accomplish.

The 1800s are long gone. Time to move on.
And that VPN would connect to ... the office network where everybody runs outlook ? Or does it connect to a set of machines that run ssh with passwords shared with forums on the internet ? This configuration, incidentally, is probably exactly what the factory was running.

There are a number of things that are commonly brought up as solutions to security. VPN's, Anti-virus, IDS, disabling USB, nat, ... none of them are. The solution to security problems is knowing all possible interactions between your software and the outside world. If you don't, there is at least a good chance it can be hacked.

Of course, not having to know all interactions, some would say, is the reason we have computers in the first place.
I think that depends on how good is the framework is architecturally sound in the beginning AND where you work.

I had a case where we had our own internal framework. Its okay. But the team turnover is quite bad to an already tight deadline that I had to re-explain everything every time a new dev comes in. That framework has no routing(its basically for multipage app) and guess what, if someone decide that they need routing, that guy is going to create his own, and there might be two of these guys, so then we have two ways of doing routing then.

And given the fact that this team has high turn over and tight deadline, I don't think you can say that it'd make a cohesive team, and the communication channel that everyone has is already overloaded (loads of meetings).

Sure, that may be a bad project to begin with, but that would be a different story.

In this case, at least for me, using a standard framework would be no brainer.
It's an interesting case of misplaced good intentions though. Here's someone with good intentions providing direct, actionable feedback. And getting negative feedback. It's how the system is supposed to work, but I hope a lot folks realize their well-intentioned comment that gets downvoted might well be getting downvoted for similar reasons: your good intentions are misplaced.
Wired had a good article yesterday too, that made clear that there is still a lot of uncertainty. http://www.wired.com/2014/12/sony-north-korea-hack-experts-d...
I'm a huge fan of ReactJS, however it isn't a perfect or optimal implementation of it's concepts. Having a purely functional frontend, with immutability is key. ReactJS is leaky in it's mix of imperative and declarative code. FluxJS also suffers from this same issue.

ReactJS is the gateway drug to frontend nirvana. For more info:

http://computationallyendowed.com/blog/2014/07/20/reactive-m... (MVC in a Reactive World)
http://elm-lang.org (ELM Language)
https://github.com/swannodette/om (Om/Clojurescript)

These will be _the_ technologies and approaches in 2015. ReactJS/FluxJS are great, but imperfect implementations!
Out of the 5 possibilities Schneier listed, I found #1 (the one picked by FBI) mostly likely.

> This is the work of independent North Korean nationals.

Mr. Schneier doesn't clearly understand people who lived in a totalitarian country. If this national lives in North Korean, there is no way he will dare such an attack without being instructed by the government. This level of freedom doesn't exist in his mind. And it doesn't make sense for a North Korean still holding the same ideology to live outside North Korea, he would either completely abandoned that or go back to North Korea.

> This is the work of hackers who had no idea that there was a North Korean connection to Sony until they read about it in the media.

This doesn't explain the Korean language used in the code. It might be a South Korean, but from my knowledge, it's very hard to imagine a South Korean risking going to the jail either fighting for North Korean or even find it fun. (Hint - South Korean people don't like the people from north who are pointing Thousands of cannons and missiles to them). As for why this is not the same encoding as North Korean dialect, I know people from mainland China use encoding of Traditional Chinese from Taiwan. It is very easy for me the imagine that North Korean government offices use such settings so that they can access resources from South Korea (much more abundant and still without language barrier.)

> It could have been an insider

This hacker has been hurting regular Sony employees. From my understanding, only people with mental problems will direct their hatred towards a company to random regular employees (his own ex-coworkers). People with mental problems don't usually possess the hacking skills demonstrated in this case.

> The initial attack was not a North Korean government operation, but was co-opted by the government.

It is hard to imagine a hacker targeting Sony with the plan to profit from selling the information to North Korean government and then intentionally leave some trace towards North Korea (the Korean language in code). This attack must have originated from North Korea, and that's the conclusion FBI is suggesting.
There is something here: that basic income has been tried. I wasn't aware of that, and although there's precious little conclusion to be drawn it is important to know that it has happened.
> * The next time you visit the page, or any page which requires you to pass reCAPTCHA, the information from these cookies is used to identify whether you have passed the test before.

This is wrong. Try posting a few times in 4chan, even if it recognizes you as a human, after posting a bit more it will ask for the captcha anyway.
AWS Will Give You $1,000 in Credit for Completing These EdX Courses
> assuming the client has provided an informed consent

How would the client be informed on issues such as

* proper vehicle maintenance records

* prior criminal record

* history of accidents and insurance claims

* presence of proper insurance to cover client's medical costs or property loss costs in case of an accident

This is something that is required of properly licensed transportation companies (i.e. anybody working under Uber Black). Until the client has a quick and convenient way to research that information, we can only pretend the consent is informed.
Why not downgrade to Mountain Lion? Security updates?
Wouldn't it be that persons job to advocate for SSL? I can't imagine it's that hard to sell "bank-level encryption to prevent a Target-like credit card leak" to the higher ups, especially at a company as relatively tech-forward as Starbucks.
Shift AST Spec: A New Abstract Syntax Tree for JS
Do you have any more information about partage's "overlays" concept? I can't find anything for those words...
It is a bit of a pain to get everything all set up, but once you do, you can use moz-git-tools [1] to just do:

git bz attach -e HEAD

...and then it will figure out which bug to attach it to, bring up a little file to edit so you can change the commit message, and it will automatically attach the patch to the bug. You can also set reviewer flags, obsolete other patches, etc., at the same time.

[1] https://github.com/mozilla/moz-git-tools
Might help to disable all those animations/transitions they keep adding. I have entered these defaults settings on all my Macs and they have sped up my experience a lot:

http://apple.stackexchange.com/a/63477/70074
It's your Starbucks Card balance, not a credit card. Still, not great, but not as bad as it seems.
> "architecture is hard, so let the smart people at Google handle it."

You are misunderstanding. I and others don't say its hard therefore we will get all our answers from one prophet.

We can look at lots of options (including rolling your own) then make a choice. Once I made a choice for a project its smart to comply with the architecture and principles provided by that choice.

I do the same thing on the web I do everywhere else. I dont write my own gui librarys or databases. I look at databases, evaluate them based on my needs and pick one or more. If I choice SQLDB I will not use it like a key value store, thus the database from now on forces me into a pattern, but that is alright because I have voluntarily made that choice.

If I have other needs I have to evaluate if I would rather bend SQLDB or add another database.

Knowing architecture is required for your choice but its a skill that you should not apply every day. Once you have to make your product happen in that architecture. It does no good to constantly rethink your hole stack.
It's not only the frameworks. Working with JavaScript has become ridiculously complicated. I remember when I started developing JSF applications. You had to learn about application servers, servlets, Spring, MySql, Maven, Hibernate JSF, JSP and the various JSF extensions before you could even start working. JavaScript now has become almost the same with Bower, NPM, Angular MongoDB Grunt, Compass, Jade and whatnot. Nowadays, when I start a project I try to keep it as simple as possible because

a) Todays technology is deprecated tomorrow

b) When someone joins I'm the one who'll have to teach them
Hi Homakov,

Our post was inspired from yours. We have added to the link to your original blog post now. Good one!

Updated here: http://www.shieldsquare.com/blog/sorry-google-captcha-recapt...
You can also manually change the URL to https, without logging in. A redirect would be good practice.
They aren't asking for your "credit card" no, are they? Just starbucks cards.
That's true, and I responded to a comment that even included the phrase "trademarked bottles." I simply wanted to point out that Coca Cola owns more than the formula.

That's not to suggest that I would want to work in a building shaped like a bottle, a can, a newspaper, toilet bowl cleaner, or anything other than a building.
Google's NoCaptcha required me once to select the cakes in a grid of 9 images. Only once, never again. I wonder if they were testing it or they have a rate between using text and images.
These are REALLY BAD examples, the safe rust version isn't parallelized but the two others are. The unsafe version is just translated C as people already stated. A safe version these days (heading towards 1.0) shouldn't be far of the unsafe versions.
Correct me if I'm wrong, but this isn't a credit card number it's asking for but a gift card number.

Should it still be secure? Sure, why not.

Would somebody go through the effort to hack Starbucks to get gift card numbers? I don't think you can even use just the numbers, you have to have the physical card and if you lose it you lose what was on it ("Treat this card like cash")
A basic income without accounting for the Law of Rent cannot create any sustainable solution. That is why a Citizen's Dividend, funded by a Land Value Tax, is necessary.
You can transfer the balance to your own card using the information stated, I believe.
That removing the cookie resets the captcha is hardly evidence only the cookie is being used as evidence. They were humans using the captcha and Google recognized it. I would imagine a few bot requests would be allowed to follow a human solution since you've raised the "I'm a human" value pretty high, but that value would decrease on every request.
Why movies look weird at 48fps, and games are better at 60fps
This is for a Starbucks card, not a credit card. PCI compliance may not relevant, although it may be since Starbucks cards can be attached to credit cards for automatic balance reloads.

Still should be SSL though.
Barebones Architecture in Elm
Doesn't mean they don't accept credit card information, by that I mean I doubt people -only- enter starbucks cards. Still a method for people to transfer their credit card information insecurely.
You would also need the security code on the physical card to transfer the balance online.
So as a client, how would I currently pull the driver's criminal record (to check for DUIs and road rage incidents), insurance claims (to check for frequency of accidents), vehicle maintenance records (to ensure I'm not driven in something that's going to fall apart when we hit 65 mph) and proof of high liability insurance (to ensure my medical costs will be covered if an accident happens)?
One of the side effects of the lackluster speed bump the rMBP got for Mid 2014 is that you can get a cheaper, nearly identical Late 2013 model without Yosemite.
Again, it is not your credit card number they are asking for, it is your Starbucks gift card.
Sigh, sounds very familiar, like what people say about Mandarin and Cantonese, those who don't know.

This is a different hack, but I think they more reliably differentiated between North Korea and South Korea, due to the IP addresses?
"Korea seeks U.S. help in reactor hacking probe"
http://m.koreaherald.com/view.php?ud=20141222001202&ntn=0