skysight-inc/HackerNews huggingface dataset:
Show HN: Google Authenticator Compatible Hardware Token
I recently implemented 2FA for OpenVPN using Google Authenticator.

The verification code I'm using is largely based on the Google2FA class for PHP written by Phil Taylor found below:

http://www.idontplaydarts.com/2011/07/google-totp-two-factor-authentication-for-php/

One challenge I had was not everyone has a smartphone (sigh). So I needed an inexpensive hardware token option.

I found that the Authenex A-Key 3610 is compatible. [ If anyone knows of other compatible tokens please comment. ]

It's not dirt cheap but it's cheap enough for our intended audience: $25 per unit if you get less than 100 and down to half that for larger quantities.

They send you a list of SNs to private key associations for the hardware tokens you've purchased. The only catch is that they represent the 160-bit key in hex so if you're using RFC4648 formatted Base32 (e.g. the default for Google Authenticator) you just need to convert those keys. After that you can add them to your DB just like you add keys for Google Authenticator and they'll work with the same verification code.
I have a copy of this, reprinted in 1940s sandwiched into another work by MacDougall. Lots of fun for a bored child. I still shuffle cards in the rather striking way he describes:

Cut the deck perfectly in half. This is easier than it sounds.

Pincer the halves at the end, and push the two other ends together.

Push harder, smoothly, and rotate your wrists opposite slightly. The two halves will fan into each other. With practice you can perform 2 (4?) perfect shuffles and end up with the cards in the same order you started in.
Noncompetes are generally not enforceable in California.
Developer Burnouts – Why and How Not To
The Man to Know in Ancient Rome
Given the presence of https://github.com/facebook/css-layout it will probably flex-based. Not cool as a constraint based layout but good enough for easier portability of knowledge.
You've probably just gotten bored of the screen because it doesn't show you anything interesting anymore. It is too predictably laden with poor content. That is a fixable problem, though.
Prometheus: A Next-Generation Monitoring System
I've been using helm-projectile's helm-projectile-ag in emacs (on prelude) a lot lately. It's very nice to have live filtering while you type a query, and the ability to search for symbol at point.

https://tuhdo.github.io/helm-projectile.html
On one hand this seems pretty reasonable. I'm assuming you're going to be out between 20 and 40k if you use a recruiter in the bay area. You can play a lot of games like this if you have 20 to 40k. Reading between the lines it seems like they also select for single/childless people, unless you really expect people to show up with their spouse and children.

Stepping back a moment, I'm stunned and thankful to be an engineer in an environment where lots of people are willing to throw stuff like this at me in return for the possibility I might deign to work with them. Sure beats spamming dozens of companies with resumes and beating my way through hr.
I think I read somewhere about rumors of intelligence agencies availabilty zone, under physical control of US intelligence agencies.

After all, at a massive scale, having access to industry standard tools for provisionning makes sense: give $$$ to AMZN for their software stack and hw integration cost probably less than building your own...?

AWS GovCloud exist solely for this purpose:
http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/what...

A really private AV zone is just a step away: put gov guards at the entrance of DCs, replace all AWS teams by in-house personnel (or have AWS teams sworned in at the relevant level...?)
Metaprogramming Elixir: Write Less Code, Get More Done (and Have Fun)
The problem is that the people that use the gem (developers) are not the people that write checks.
Of course a large fraction of these types are too proud to do that.

One thing I always look for, in every member of a startup, is that they aren't too proud "to sweep the floors" if needed.
This is really awesome. I hope to go again one day to SF and stay some days at HackerSurfing.
Give us a few months...
Oh sorry I thought it was launched recently. Thanks for info.
How can the host be accountable for not having enough manpower to deal with abusive videos people upload to the service?
It takes 8 perfect shuffles to get back to the start.

https://en.wikipedia.org/wiki/Faro_shuffle
Glibc adventures – the forgotten chunks [pdf]
I saw an animal torture video once. It went very fast and because I was in both a state of shock/fear/sadness/whatever, I couldn't even get myself to stop, pause or close it in time. The torture just happened too fast.

I own and care a great deal for my own pets. So what happened to the same animals in the video.. it haunted me for weeks and was a really depressing experience.

Sure, I'm more careful now.. heck, I'm even outright censoring a lot of stuff from myself, because of this experience.

But it sounds like you are saying "videos can never do harm" and I just really disagree with this, because of how I was affected by this particular one.
There's some spectrum between:

1) a shared consumer service (i.e. a bunch of gmail accounts in the public namespace)

2) some kind of dedicated-instance-within app service (which seems to be how google apps for your domain works)

3) container/vm based isolation of app service (i.e. a provider who runs dedicated VMs of their own or standard platforms for people...I think some of the hosted exchange options are like this)

4) dedicated servers but with provider retaining root, but a third party or your own staff doing app administration on mail server

5) #4 but without root for provider, but with normal machines and thus singleuser

6) #4/5 with encrypted disk, such that it would be trickier

7) Colo vs. dedicated servers, with full crypto.

8) On-premise

I personally think the correct option for most organizations for mail is absolute-minimum 3, maybe 4. I feel uncomfortable less than 6. For someone like wikileaks, you are abjectly incompetent other than 7 or 8, at least using commodity technology today.
Any links on React Native?!
Link to the actual book : https://books.google.com/books?id=_7wyAQAAMAAJ&printsec=fron...
a general drawback of k-means. You have to select the k. In practice you try a range and see how well they summarize your data (e.g. leave one out cross validation).

You could do that here too, just have a range of k. If only there were a streaming leave-one-out cross validation for k-means to complement this approach ...

(it is possible to do this in a streaming style, see LWPR)
Tannhauser gate
You can usually watch at least the last 3 - 5 episodes on either Hulu or ABC streaming. Also if you live in most major cities, you can also get it for free via old school antenna.
Very nice.

How's this better/different than Crapify?

https://www.npmjs.com/package/crapify
How to BE FABULOUS
Did this with dummynet on FreeBSD around 1999. Made it a bridge though, so everyone on the test network could "enjoy" 28.8kbaud dialup experience! Great fun.

Called it "the molasses network", which is what they should change the name to before Comcast smokes them.
> You know what you need to do, to keep these teams happy? You need to continue have a minimal tool that does the thing that people need -- screen sharing -- and does it well, instead of bludgeoning them a massive general-purpose communications suite that they don't want, which is essentially what you were just cheering about in your recent email.

This is absolutely, 100% the way I feel. I look back to AOL Instant Messenger as a classic example of a product that forgot to do one thing well... and that's why I bet you hadn't thought of AIM for quite some time before reading this.

That said, best of luck to Screenhero going forward. Video chat w/ screen sharing is a crowded space and I'm sure they needed to hedge their bets.
This is a common question for me: how to determine dynamically the number of clusters (including the splitting / merging). I've looked into jenks breaks, but it also seems to require a cluster number.

http://en.wikipedia.org/wiki/Jenks_natural_breaks_optimizati...

Do you have any advice or ideas for automatically picking count of clusters in an unknown data set?
Hi there!

Is there a timeline for Intel Edison support?

thanks!
The rough answer (I'm not an expert) is that you can deduct costs for a room used 100% for business.

Put a TV in it and you're at risk of it being considered personal space.

I think it's possible to deduct a space as some fraction of the time used for work, but there may be a minimum threshold? I know it can work at 100%, but it's hard to prove 100% business usage -- and I've also heard that it's a tax audit trigger (as in, it raises your chance of being audited).
Rusty bits: product types, sum types, matches
I agree very much. I didn't find this interesting, nor did it gratify my intellectual curiosity. Glad it's off the front page.

Would be terrible if HN devolved into a mess of posts about how dumb and hateful random comments are on the internet and turned into another outrage generating machine (just like the TV news you mentioned).

BTW, here's a nice HN alternative that someone pointed me to recently (for those of us that are sad to see what HN is devolving into):

https://lobste.rs
Interesting. What were the costs like? of the different components of the stay there, not just Internet. I've been in some remote places on vacation, but some of them did not have good Internet access or it was expensive.
Can someone explain to me why virtual DOM is faster than DOM implementations of browsers?
I mean "sure" only as a manner of speaking, not to say that I am absolutely certain. The challenge for me in using the illegal opcodes is internalizing them and recognizing the situations where they can actually be used effectively to save a byte or a cycle. When writing code for platforms with very little memory or harsh time constraints, they can certainly save you headaches. Something like LAX for example can be used to do an y-indexed load to the x register, which often times can save you an accumulator transfer when doing doubly indirect loads.
The actual content is encrypted, but one can still build an index that points to individual email IDs and score the search results properly. Only when returning the top N results that one needs to decrypt those N emails with the right keys. The index would be kept in the server. Of course, the devil is in the details and things like email threading, order by by date or group by senders will make or break the user experience.
Here's a nice video by Richard Turner demonstrating various card manipulation techniques:

https://www.youtube.com/watch?v=11R-jy8DZt8
Thanks! We are looking forward to doing more awesome for you :)
Scientists in China and US chart latest discoveries of iron-based superconductors
Sure, but then there's Sidekiq Pro which does alright. Something is compelling developers to ask their bosses to write a check.
Co-written by http://www.publicize.co/ so let's link to their website as well. I read 8+ YC companies already work with them. Starts at $399/month.
Sounds wonderful until you have actually tried to integrate IMAP "supported" email services, such as Gmail. What makes it hard is that different providers have different implementations which very often do not follow the protocol spec. Microsoft, Google, Yahoo all have their own higher-level API for email access, and every modern email tool ends up making something like Nilas, with a server taking care of pushes and managing logic for each provider. The industry needs a new standard, and that is why ideas such as Nilas seem exciting.
As someone who has been on the net since the 1980s, I (still) love the Internet and technology as a whole.

On the other hand I absolutely loathe the still-spreading BuzzFeedification of virtually everything online.

It is really starting to drive me nuts. If only I knew one weird trick to filter all this shit out from the rest of what I use the Internet for, but even when you try to avoid it it tends to seep in through all of the social connections from other uses of the net.
There are added benefits for an immutable / FRP style of building a UI, but I think you're more interested in the rest of my answer.

Nothing to be confused about, you have a valid hypothesis: "Rendering and Diffing in Javascript is slower than DOM manipulation". However, all hypothesis need to be experimented before having any real meaning.

It just happens that testing this hypothesis and finding it invalid was the foundation for React.

Watch this video[https://www.youtube.com/watch?v=XxVg_s8xAms] I think it does a good job discussing this hypothesis and why they chose not to worry about it.
I am also too late. http://buyfrom.farm
Sure you can. If, for (bloated, demonstration-only) example, your opaque managed pointer type is actually this under the hood:
struct pointer {
void * real_base;
size_t size;
size_t offset;
};

then
type * p = &arr[i]

translates to
struct pointer p = { arr, sizeof(arr), i * sizeof(arr[0]) }

Any any use of "(p + j)" or "p[j]" can check that (p->offset + j sizeof(p)) is greater than or equal to 0 and less than p->size. (Excuse my confused use of types in the above.)

"there might be existing C programs that rely on out of bounds access (where they know that the out of bounds access falls into safe memory)"

Those programs are completely non-portable. They could break with your next compiler upgrade, let alone moving to a different compiler (clang?) or a different OS (BSD?).

It could happen. Witness the people who complained about their broken programs when memcopy() was sped up by taking advantage of the standard, or those who were surprised when NULL checks started being discarded after a pointer had already been dereferenced.

Even so, if you did have such programs, and were unlucky enough to rely on them, and were unable to fix them to comply with the C language spec, there's no reason you couldn't still compile them for the existing bare-metal ABI. I'm not proposing to ban* the x86-64 ABI. I'm just saying lets create an additional (x86-64-safe?) ABI that we could use to provide a safe execution environment for a subset of our existing code. That subset could range from none of it to all of it, depending on how much you personally valued speed and anti-bloat over safety, how many non-conforming programs you relied upon, and whatever other factors you wanted to take into account.
In Islam, Muslims are to obey what the prophet says and follow how he behaves and lives (Qoran, Hashr 7, Nejm 3-5, Maaide 99, Neesa 13-14 [1]). So, sometimes some religious rules in modern Islam are rooted in hadiths, not directly the Qoran itself. There are hadiths that forbid depiction of the quick [2]. Also, some consider depiction and other forms of art to be sheerk[1], which means pretending or comparing oneself to God, trying to be godlike, which is sin (Hashr 24, Araph 11 can be interpreted to tell that creating and shaping are attributes of the God).

Thus there are various interpretations of Islam's allowance and tolerance of depiction of the things, the quick, the people, the prophecy and its particular prophet Mohammed. Sunnis, which are Turks and majority of Arabs as far as I know, loathe and are averse to depictions to some extent. More religious older people in Turkey refrain from being depicted anyhow, while some are fine with memorial pictures of themselves and relatives. Majority of the community is though, do not oppose any sort of picturing apart from Mohammed's, and they are taking and publishing pictures of themselves and other people and objects, animate or not, as everybody does. I have heard that Shiites are also lax regarding prophetical depictions, but I have not encountered personally the shiite culture, so, I do not really know.

So, it all boils down to the fact that when someone, Muslim or not, publishes visual material regarding Mohammed, and the God in an islamic context, they should be ready to face different reactions from different parts of the Islamic community. And, as we are living in the internet age, where information goes from Alaska to Iraq in the speed of light (figuratively), its no surprise that living in a non-muslim community does not matter at all in this context.

One would be offended when somebody tries to hurt or offend someone who he considers to be more worthy to him than himself, right? Well, the verse Ahzab 6 [1] says that Mohammed is more worthy to a Muslim than himself.

[1] I have tried to phonetically reproduce names of soorahs and religious terms, I do not guarantee they are correct.

[2] Now, I am not that familiar with hadiths and how these are really cited, but here are some citations nevertheless: Müslim 2107/96; Müslim 2107/90, 94; Buhari 5957, 5958; Müslim 2107/87, and others.
Very cool, though personally I'm not interested in moving back to the Bay Area.

The site implies that you're not interested in remote employees, which is a shame; not everyone wants to live in California, and some people have an extended track record of successfully working remotely (ahem ;).
Here is thirteen bytes of your program:

var d = docum
I spend 12 hours a day before screens. I'm sick of it. I want to work in the sun and be around people again. But this Tyranny of Screens is hard to escape.
He seems to be arguing against himself, probably hoping that the reader only notices one half of each argument.

First he argues that the nuclear bombs weren't that important, or different from our other bombs. Okay, fine. Then he argues that we persist the myth that the bombings ended the war because it helps us feel better about having dropped them. But if they weren't that different from our other bombings, why would we even need the lie to feel better about them?

Similarly with his timing. August 6th -> 9th was (he feels) both too long a wait to deal with the crisis, but also too quick, since the preliminary report about the bombings didn't arrive until the 10th.

And invasions: they didn't surrender at the threat of a possible US invasion, but a possible soviet invasion caused an immediate surrender?

As an argument that the Japanese surrender was more complicated than "we dropped a bomb, they surrendered"—well, obviously that's true. History is never that simple outside of textbooks for children. But in his arguments that it was irrelevant, he spends too much time contradicting himself.
I'm surprised whatever feature detection they use isn't robust against trivial changes like that. Rotation, flipping, and scaling/cropping should all result in the same hash.
http://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govc...

> Hard token multi-factor authentication (MFA) devices are not available in the AWS GovCloud (US) region.
Even people with spouses/children can afford to take a week to network/job-search.
This is an effort to fight ideas by suppression. My preference would be to fight ideas using other ideas.
Well, it prevents a single rogue employee from peeking at/stealing data. It now requires a conspiracy between employees.
My point was that if you feel like your value as a technical person is worth more than the business person who has approached you (>50%) then you shouldn't bother. Between their experience, their idea, their connections, their money, etc. they should at least equal your value or you are in trouble regardless of how the equity breaks down. Negotiations are a different topic.
Why would the sony pictures hack make self hosted any better?! Their general network was hacked, and an exchange server would of been hacked too.
Minimum viable custom elements
> We've seen recently with Apple and Google, that there is such thing as a non-backdoored encryption product that agencies (both US and abroad) get upset about.

Who says they're not pretending to get upset about them?
relevant talk by @vjeux: https://speakerdeck.com/vjeux/react-css-in-js
I'm too nervous to allow myself to do this. Plus I don't have a hot tub or a pool or even the ability to comfortablt sit in a normal tub (I'm tall)
Single-Tag Website
Google is not pre-filtering videos. But it is already "tough to catch all terror related content".
Here's the NYT article where Laszlo mentions the "random mess" they found when they used the interviewer as the predictor and then subsequently mentions how they use structured interviews now instead: http://www.nytimes.com/2013/06/20/business/in-head-hunting-b...

The interview correlations I cited are from Schmidt and Hunter, 1998: http://mavweb.mnsu.edu/howard/Schmidt%20and%20Hunter%201998%...

My point is, it doesn't matter who does the interviewing - looking for people who are "good interviewers" is a unicorn chase because the vast majority of people don't have a magical ability to guess who's going to be a good performer pre-hire. Unfortunately, Amazon is making the same mistake with their "bar raisers": http://firstround.com/article/Mechanize-Your-Hiring-Process-...

Geez, you engineers don't seem to like to learn from each other.
Just to continue on this riff:

Outside, with other people building some tangible thing together. Something that years later we can point to and say yep, it was tough, but we did that.

Not only are we stuck with our heads stuck up computers, in 50 years everything we've done will be superceded by something vastly more cool and interesting. Within 100 years it'll all be gone.

There was an article on HN recently about video game addiction. You don't have to be addicted to video games to spend your entire life in front of a screen, being a slave to IM and email, and miss out on all of the important things.

ADD: Instead of 50 and 100 years, make that 20 and 40 years. We'll still be here when it all vanishes.
Firefighters in San Francisco have an average pension of over $108,000 for life after they retire[1]. They are doing just fine pay wise.

http://blog.sfgate.com/cityinsider/2011/06/19/guess-whats-th...
That's an argument for providers implementing the spec correctly, not an argument for abandoning specifications in favor of various proprietary APIs.

We've already learned this lesson with web browsers and HTML specs, maybe we'll have to learn it again for email.
For instance a while back Mozilla was giving away old Mac minis: http://armenzg.blogspot.de/2014/05/do-you-need-used-mac-mini...
Can I create the largest possible square div in a rectangular div with this library? That is my standard test as to whether a layout framework is advanced enough to meet my basic needs. (vanilla CSS fails this test of course, even with the most recent extensions, AFAIK)
React is quite large in terms of lines-of-code. I would refer to it as a mili-framework instead of a micro one :)
Prediction: name of this project will be different within 12 months due to trademark infringement.
Aren't they going to be catching only the lowest of the low-hanging fruit using a technique like this, or am I giving terrorists too much credit? Wouldn't the ones engaging in actual criminal actions be using encrypted services, encrypted files, VPNs, etc. and not just randomly uploading things in the open from their devices to mainstream websites?
Propaganda, especially recruiting. http://www.nbcnews.com/storyline/isis-terror/isis-releases-h...
Transpile.js from Facebook/css-layout
It is kind of silly ... in tech, we've got all these amazing tools that enable people to work remotely. I've seen people checkout even though they come in to the office, and people work like superstars while they are remote and working in the middle of nowhere. If you get on a plane once every month or so to hang out with the team, I can't see how it affects anything.

Same is true of investors. Not every great idea in tech comes from the valley.
If it's on DO, then does it legally count as self-hosting? I was under the impression that you needed to physically own your own hardware.
It was just announced at React.js Conf: https://news.ycombinator.com/item?id=8961551
Can you explain the difference between HSM and HSA, or at least point to a good resource for understanding the difference? Thanks.