skysight-inc/HackerNews huggingface dataset:
In what world does the recipe for Coca Cola in any way influence the maintenance of a fleet of trucks?

Google's policy is responsible disclosure. Wavering on the well-known deadline would become a political headache. If you give a mouse a cookie... Two days becomes a week; a week becomes half of a month; half a month becomes a full month. Perhaps if Google is feeling generous, they could not disclose a vulnerability to a vendor until a later time (for example, if a vulnerability is found just before a well-known extended holiday or something) thus automatically "extending" the expiration of the quiet period. But that still leaves us, the users, more vulnerable for longer if the bad guys were already aware of the problem.

On a slight tangent, Microsoft's policy to not release security patches as soon as they're available (and instead wait until "patch Tuesday") harms us all. They don't have to forcibly push the fixes, but immediate availability would be a tremendous improvement.
The linked bug shows that it was discovered Sep 30 and revealed publicly on Dec 30. Thus MS missed the deadline by two weeks, not two days. I agree there should be some flexibility but where do you draw the line?
I don't see it as bait-and-switch, either. Uber makes it clear when the ride you're considering will be subject to surge pricing, and it's very easy to abandon the reservation at that stage. I can't think of a time (in NYC) that I've seen surge pricing and been surprised, it's always been during inclement weather or peak times (e.g., Valentine's Day, New Year's Eve).
I have a friend that works here. Apparently the job interview process is tough. Very technical. Tons of questions involving algorithms. I'm tempted to apply just for the challenge.

The perks are nice. They have an onsite chef so you can have a catered meal for breakfast, lunch, and dinner. Apparently a masseuse comes in every month(?) or so for free massages. Seems like a nice gig for the programmers.
It's a darn good policy if you're the one who is responsible to apply the patches inside of your organisation and you have to test the effect of the patches to the applications running in your company before you actually install them.

Applying the patch a few days later typically doesn't noticeably increase your risks but rolling them out unchecked can make some serious damage.
An excessive list of free services for open source projects
Does anyone know some of this?

Comments are welcomed! Let's make our own list of free for open source services!

IMPORTANT. Like @dewey proposed - this will be in standalone GitHub repository. Pull requests welcome!

https://github.com/velikanov/opensource-candies

I mean like:

- - - - - Version Control - - - - -

BitBucket (https://bitbucket.org/) - free for open source and private repositories

GitHub (https://github.com/) - free for open source repositories, paid for private repositories

- - - - - Continuous Integration - - - - -

AppVeyor (http://www.appveyor.com/) - Continuous Integration for .NET

Coveralls (https://coveralls.io/) - Code Coverage History

Scrutinizer (https://scrutinizer-ci.com/)

Semaphore - (https://semaphoreapp.com/)

Travis CI (https://travis-ci.org/)

- - - - - Translating - - - - -

Crowdin (https://crowdin.com/) - need to request subscription

- - - - - Profiling - - - - -

YourKit (http://www.yourkit.com/) - Java Profiler

- - - - - E-mail Sending - - - - -

MailChimp (http://mailchimp.com/) - free for 12,000 emails to 2,000 subscribers
Interesting and good to know! I was actually wondering if a JS redirect would suffice.
Free data leak monitoring via Canary Alerts
I have no affiliation but do use GTmetrix quite a bit when optimizing client websites: http://gtmetrix.com/

It works like an aggregator of all the existing speed tools and provides a nice speed testing resource that is outside my local network.
It doesn't matter if Google publishes it after the patch. It matters if the publish before. If they publish before the patch, even knowing when the patch will come out, that's enforcing their demands or making MS suffer the consequences. Google knew Microsoft had a patch. Google published it anyway, because their competitor didn't work fast enough, for Google's definition of "fast enough".

Journalists are not directly competing with tech companies. Google is. Imagine the next bug they find in Windows, and they publish it saying "ChromeOS doesn't have this bug!". They already use their search to push their browser, why not use their bug reporting to push their OS? When does free speech stop and anti-competitive behavior start? Would Google publish their own vulnerability if they were unable to fix it in 90 days?
"Our objective is to significantly reduce the number of people harmed by targeted attacks." (http://googleprojectzero.blogspot.co.uk/2014/07/announcing-p...)

They've lost sight of this noble objective with an inflexible policy; who anointed Project Zero guardians of the internet? Why not wait the two days? cui bono?
Hey, it's not like you bought the car and then suddenly found out that it had Stop&Start system. You knew what you were buying. And you are saying that it doesn't work for you? I am curious - what does it do then? Doesn't start the engine after stopping it? Then it's malfunctioning.
A Strategy for Business Success
The point of the two days isn't the two days - it's to establish the principal that the release date is negotiable, and it should depend on patch readiness.

You start out with two days because of patch tuesday. Then next time a bug is reported, well, this is a busy month with lots of people on holiday, if we could have an extra 10 days? And the next time, we're really close to releasing Service Pack N, the fix will be in that but it's got lots of changes - it'll be out in 60 days...
I liked chaining expressions for things that were done in memory and query style for deferred. My brain handled the code a bit better when things were written that way.
The "90 days" policy is a completely arbitrary Google-only policy. There is no reason they couldn't wait a bit longer before disclosing.
I call bullshit on this analysis. There's no way the code would be using integers to represent speed (they'd just be rendered as integers). >= and > are essentially the same operation when comparing floating point values.
Working smarter: Improving my design process for new projects
How does Spotify count users? They can game the proportion of paying/non-paying users by discounting infrequent unpaid users, for example. A more interesting number might be the number of /plays/ by paid vs. unpaid users. I.e., normalize it for activity.
Isn't the VS Community edition free now anyway?
The last place I worked that cared if I was 5 minutes late to work was Wal-Mart when I was a teenager.
BitBucket (https://bitbucket.org/) - Version Control - totally free for open source projects
> Could you expand on this? I'm interested in your thoughts.

Sure! Here goes...

SEO was supposed to give you a competitive advantage, with your highly-optimized site appearing ahead of your (supposedly) less-optimized rivals in the search rankings. With the majority of above-the-fold space on Google being taken up by ads, those looking for free traffic via organic SEO are really just fighting for scraps.

For the past few years, the companies I have been working with have been competing for rankings on relevant search key terms on Adwords with their rivals, meaning the guys with the biggest advertising budgets wins (and Google wins either way). Organic SEO does not suit Google, in terms of their business model. They want you to pay for placement.
Ycombinatoe.com
It's a kind of thinking of the bureaucrat and not of an engineer. I'm the later, and in my areas of work the tolerance of 10% is the default, the tolerance of 20% or 25% is also natural, and only something more than that is something that is even worth the words.

As far as I know, some other engineering areas have even the safety factor of 2 or 3. That means, you expect the stress x, but your process has to sustain even 3 x.

Edit: Zero tolerances are never a good idea.

http://civilrightsproject.ucla.edu/research/k-12-education/s...
I'm a paying user. My fiance pays as well. It's a great service, but I wish they would come out with a "family plan" or something. Often we are both listening at the same time to a single account which negates the utility of having two separate accounts quite a bit. However, at work we both listen to our separate accounts and listening to the same account would not be feasible. Netflix allows for multiple queues for different users, I think Spotify should follow suit.
Because there is an entire generation of driver now weaned on Uber. They're all over London: guys who got a foot onto the driving ladder and know no other way. They take what they're given.

The disaffected professionals are probably the ones who bitch and gripe about money compared to the old days. Uber is now trying to swallow up huge amounts of market share by creating mammoth demand which will presumably lead to more drivers (who haven't been weaned on better-paying services).
I once talked to a taxi driver (who didn't own the medallion), who said he paid the owner $1,500 per month to drive for him. Plus the cost of his car, gas, and high insurance. He had to earn $3,000 per month just to break even.

Taxi drivers never made a lot of money, even in the old system. But at least the system protected them to a degree by limiting competition. Now there is no protection. It's a free market. Anyone with a Toyota Yaris can fire up Uber-X and compete during the busy couple of hours of the night. It will be a race to the bottom for driver incomes, for sure.
I haven't touched Java since school yet it feels like nothing major has changed in terms of writing code (outside of tools of course).
I haven't coded in C# for 2 years and I feel like I need some time to catch up. Seeing the difference between the languages makes me feel like people who only do Java are going to be hopelessly left behind.
OpenStack application stack provisioning using heat templates and opencontrail
"everybody agree on a standard prefix for basic things
like calculators" HAHAHAHAHAHAHAHAHAHAHA

That's a URN. Unfortunately they never really got adopted. But thy solve this exact problem.

urn:calc:rpn

You click the link and your mobile phone then looks to see if any of your calculator apps satisfy that urn.

If they find any they open it up or present the user with a choice between them or open the one the user configured as their choice.

If they don't find any they check the app store or web and offer the user the opportunity to install one that satisfies that urn.

Actually this is exactly what androids intents do as well minus the app search and install. But I don't think they use urns under the hood.
Which they're doing with Windows 10. Consumers get them now, business get them on Tuesday. Have you ever deployed patches to a couple thousand machines? It's not something you want to do every night.
In my experience local car services (taxis) or a combo of public transport and taxi have always been cheaper.

Uber rides to downtown back to my house ~$100-150, Taxi ~$75-125, MARTA/Taxi combo ~$40-75. I hope to see the prices decrease for Uber.

The things that Uber really has going for it that I absolutely hate about Taxis are getting the price up front and knowing when the driver is going to be there. Taxi's will never update you to say if they are coming or not and many times I have been left out in the cold waiting for taxis that never comes.
The price cutting makes me more reluctant to use car services...and I realize I'm speaking from a position of privilege here in which I can say that I have enough expendable income to not be against paying a little more for the drivers. I feel that the wage is already so low that it's impossible not to feel guilty using them, what with all the other costs they have to deal with. I try to be as conscientious of a user as I can be: I'll watch the app and only request a ride if a driver is fewer than 3 minutes away from me. And if I have a driver take me from somewhere busy on a busy night to a more secluded area (thus denying him/her the easier fares in the busy area), I'll usually tip.

The car services are already such an improvement (in terms of technology) over taxi services that I'm happy to pay for the convenience. And I'm getting less and less enthusiastic about funding a race to the bottom, nevermind the impact it has on customer service.
If contacted by the other party and they give a good reason (in this case: "We have a fix, it's slated for release in line with other things on tuesday"), I think a responsible security researcher should give that time. If patch day rolls around and no production, go ahead and shame. This is not a case of overhead, MS world functions a bit differently from package management in Linux.
If you're in the US, they have this already:

https://www.spotify.com/us/family/

It launched a few months ago.
I can't agree. In short, the communications
can be done with forms, on a smartphone,
Web site, or similar.
31 is approximately 30
It may help Uber out on the short term since they are only looking at the numbers but not their drivers or their customers.

You're dealing with humans here and nobody wants to work twice as hard for the same amount of money or very slightly more.

So what happens is that the quality slips and good drivers will go where there's more money to be earned easily.

There's a limit to how low you can drive the prices before the good contractors start ditching the ship.

I foresee bad things in Uber's future.
Isn't this all MS's fault for having a security flaw in their system?

If the Project Zero programmers were independent or malicious, they could have sold this information or released it without giving the 90 day window.

Seems like Google is trying to do the right thing by alerting others on these flaws and holding a fast deadline to fix it.
You could outsource your customer service to taxi drivers
I think the type of animations make this feel slow when it is actually not slow.
I'm sure this isn't real or just a fun joke. Please don't consider using a :checkered_flag: emoji to indicate you are fixing something on Windows, or any of these other icons.

Or:

Please consider using these emoji, but please don't anticipate or expect other developers will have any idea what their usage means.
That's true. In Guatemala the developer salary is around $800 - $2000 / Month. And minimum wage is around $312.
Benefits of Plain English URLs
Typically, APM/MavLink runs on a Arduino (my Quanum CX-20 quad runs an Mega 2650). This looks like this is a Raspberry Pi shield that I suspect contains an ATmega - so it's not Linux that is doing the flight controlling.
Houston, TX - We are hiring Web Apps developers with GO language experience and object-oriented backgrounds who are strong in the LAMP stack. MongoDB experience a plus. Immediate high profile wifi integration project. US Citizen or US Permanent Resident. Contact amy.gordy@talentorchard.com.
Google’s No Captcha reCaptchas may not be as bot-proof as we thought
Quick and Easy: Embeddable Highcharts Code Generator
I wanted to say this, but evidently it was pointless given that seemingly 80% the people on this thread have absolutely no understanding of change management whatsoever, or more importantly the problems you might face when customers have your update infrastructure indirectly linked to national grids and industrial automation. Clearly Microsoft should just release Windows as a repo on GitHub and push fixes to master.
I received an email notification from Uber that the fare for my most used route is dropping 46%. My normally route is only about $8, so it might be a best case scenario.
Will scale for food
I'm the co-founder of a SaaS company. Our product is not quite a best-seller, but we have learned to scale apps in reliable and cheap way, by combining cloud-based services (e.g., AWS) and leased servers. To generate some revenues, I would like to offer tailored scalability analysis, architecture design, implementation and sys-admin services. Where can I start?
Possibly not. It seems that this runs APM, which is an open source autopilot system. On their install pages, the Raspberry Pi is listed as a companion computer (presumably to be hooked to some other device that runs the code) (which this system might not do) but the Beaglebone Black (which I guess is similar to the Raspberry Pi, so might be what they do here) requires installation of realtime patches for Linux.

This works by patching the Linux kernel to make almost all of it preemptable, (replacing spinlocks with mutexes) so interrupts can be acted on more quickly.
It might be time for me to stop worrying about IE8 and embrace `transform`-dependent icons.

I regularly create one-off semantic icons as long as they don't rely on `transform`. That limits it to ones based on a character glyph - (i), (?), (x), etc - strictly orthogonal blocks - (+), (-), etc. - or CSS triangles - mostly arrows (which don't always render great anywho).

I'm always too concerned about the fallback in browsers without `transform`. But really, that's illogical - it's just IE <= 8, and generally don't need to worry about that support anyways. I guess my hangup is that the meaning of the icon gets garbled when it isn't displayed correctly in older browsers, and that seems like it crosses a line. (Thought about the "semantics" of an icon quickly feels like Philosophy 101 and probably means its time to get back to work!)

As others have pointed out, I wouldn't use the pixel-based positioning/widths as this does, but `em`s, `rem`s or `percent`s. Relying on `tranform: scale(x)` would complicate layout flows - for one thing you'd always need to compensate for the scale with `margin`, `padding`, or other pixel-budging.
Electric-Car Pioneer Elon Musk Charges Head-On at Detroit
Do your taxi prices include the tip? And did you price out the MARTA/Uber combo?
Readers played important role in factories
All I could think: it's still sunk in too much architecture....
I had a parking lot attendant at work who for years was always on his phone when I arrived. One day I asked him who he always talks to. He says he has another business besides the parking lot. So maybe at least some of these cabs are having business calls as well. If you can hustle to be a cab driver, you can hustle in other ways as well at the same time.
Online Pentest Educational Material
The Ultimate Cheat Sheet on Communication Across Time Zones
I really want to like functional programming, but the functional version of each of these seems less readable and more verbose.
This is a huge problem indeed!
The product I'm building is trying to solve this problem as well, by giving more tools for the recruiters to identify potentially great candidates.
If it was primarily about Windows, wouldn't .Net or C++/Win32 be of more interest? Microsoft has no official Go support as far as I know.
Actually we run APM code ported to Linux, there is no Atmega on the board. There was a lot done to make this possible including special real-time Raspbian. It flies very stable and with great timing performance.
if the money never gets to the artists what is the point? its good to build up an infrastructure but this is more to keep the industry's pockets lined than the artists, so i've seen at least a few who encourage to just torrent their work instead.

there are some who argue that the pricing model is not really incorrect/askew, but i think even they tend to admit that its insignificant income from the perspective of the artist.

(as someone who is not into pop music, i really don't care about building a whole economic/industrial mechanism just to make sure that beyonce & WMG keep getting a disproportionately large piece of the pie compared to independents, that is not really in the spirit of the internet IMHO it is just a web-based continuation of the old system that smaller artists hated...)
Yes search engines make their money from adverts, but without decent organic listings (where ~90% click volume still goes), there's going to be no one to click to ads. It's a fairly simple mechanic.

SEO is likely depreciating gradually as Google gets better at 1) devaluing link spam and 2) accessing and assessing website content for its meaning, but it's unlikely to ever be perfect at doing either.
So... emoji, but still horrible performance? Moving on...

Really? Downvotes without a response? Seems awfully cowardly. So I'll just assume the performance has improved to the point that opening a large file doesn't cause it to lockup for an hour? Because that seems a lot more important to me than emoji's for commits...

*nope, just tried it again, performance still blows.
compiled fast is quite helpful.
The standard lib is a also +1, very useful for network services.
> Most people are going to use a search engine if all they get are paid ads.

Most people will just click on the first few "results", even if they are in fact ads. They can hardly tell the difference. That's why businesses are paying so much to be on top of certain lucrative search key terms: if they we not getting a return on their advertising spend, then they would not be spending it.

My main point is, even if your website is horribly un-optimized in terms of SEO, if you have a bucket of cash to spend on Adwords, you will still get a tonne of traffic. SEO in this instance is almost irrelevant.
When you talk about "organic" links do you mean non-advertising links from other websites like blogs/news sites?

It seems like you get diminishing returns on SEO. What's the point at which you'd recommended a site stop SEO and try other means of maximizing exposures. What would these other means be?
It's fast enough in almost all cases to work. "Realtime" is more about proving worst-case bounds on all control loops.
"but why should Google bend their standard procedure to fit Microsoft?" well, there are quite a few users affected.
Oops. My bad for posting while sleep-deprived. Thanks.
I'd be happy to give you feedback. Email in profile.
As long as I'm not using C++ I don't feel harmed by any OOP features I don't have to use. I don't feel being restricted. I'm curious, what are these commonly harmful things you're talking about?

On the other hand, most FP languages I tried feel very restrictive. The only language that is inclusive of all good ideas, seems to be F#.
Well, this is specifically for contributing to Atom - and if you look at their commit messages it looks like they're at least somewhat doing just that.
If I were MS I wouldn't complain on this issue and instead I would just take the bait and put an internal team to find out bugs exclusively in Google products like for instance Android [1] and declare an arbitrary short disclosure policy [2] and then release these bugs when time is up.

[1] https://news.ycombinator.com/item?id=8874339

[2] https://nakedsecurity.sophos.com/2010/06/15/tavis-ormandy-pl...
Using the RPi as a video encoder may be the "killer app" for this. Currently, there isn't a "ready to fly" solution that will encode video and send it out over LTE.
In France too
https://www.spotify.com/fr/family/
It would drive the revenue into Uber's pockets rather than into the pockets of taxi medallion owners. So for Uber, it's a plus. For others, not so much.
Most commenting here didn't read or take into account this part:

> To reassure drivers worried about lower fares, Uber said it would guarantee a minimum fare per hour for drivers in these cities.
We run APM on Linux. The port to Raspberry Pi is our effort and it is now supported in APM upstream.
They are using a realtime patch on Raspbian. [1]

They also say "autopilot’s code works directly on Raspberry Pi using the APM’s Linux HAL". [2]

[1]: http://www.emlid.com/raspberry-pi-real-time-kernel/
[2]: http://www.emlid.com/navio-apm/
Ouch. Well, I hope your rides per hour increase 4X to make up for it.
>> "HN users are likely familiar with Genius"

They were on HN A LOT a while back because of all the controversy around them.
10 things I wish I knew on my first day at Google