skysight-inc/HackerNews huggingface dataset:
Bear in mind they don't actually need to hack or coerce a CA to get them to issue a fake cert. CAs check ownership of a website by either sending an email or doing a regular HTTP request to the website i.e. doing the sort of request that QUANTUM is very good at intercepting and redirecting.

In other words the NSA could MITM the CA<->website connection and get themselves a cert issued in the regular manner.

However I do not believe they are doing this at any meaningful scale, and possibly not at all. It's clear from the Snowden archives that they focus almost exclusively on malware. That has a lot of advantages for them over creating fake SSL certs.

Also bear in mind that certificate transparency is a multi-year plan to prevent secret issuance of certificates. So there is effort being done to reveal such attacks even before they are happening. Not too shabby!
If you know the one H1Ber in Alaska, you now know their salary.
This is an aside, but I think there's a strong case to be made for publishing salaries, with names. I know it's an intimidating step, but this information is easily found on line for public service workers. The sky hasn't fallen, and there are a number of real benefits.

One possible angle - perhaps openly publishing payroll info (name, title, pay) should be a requirement for all companies that receive an H1B or other work visa.

Keep in mind, there is precedent. Information about how much a house sold for is public. Imagine if, when you were selling your house, you only had a bit of information gleaned from conversations with neighbors here and there, whereas the buyer had a massive database at his or her disposal with exact prices for every house sold in your neighborhood in the last 50 years. You'd be at a massive disadvantage. That's the situation employees are in.
studies have shown that people driving under the influence of marijuana are extremely careful. alcohol is complete opposite.
I understand the change from methods to functions to match OpenGL, but the old bindings (go-gl/gl) were easy to use and much better than writing C. I just dont see why I'd use Go over C for this now the syntax is pretty much exactly the same.
Vooza tried this before they pivoted to local - see around 1:20:

http://vooza.com/videos/radimparency/
These things ebb and flow. Now is the right time to "Jump in" as you don't lose much from joining a startup and gain a lot of potential upside. But who knows - in 30 years, it could be the return of "the Company Person".
OP here. Your points about the convention for lowercase and aces on the upper-left are fair. However, the duplicated information in these grids was intentional. I was less interested in building a standard suited/off suited odds table (those are readily available) or a strategy tool, and more interested in a visually clear way to explore the "probability landscape". I find these grids with duplicate information easier to grasp on first viewing. I also like seeing how subtle suit-based patterns in panel 1 cancel out when you average all slices into panel 2. You can't show that unless you retain all suit information
Onsite interviews are consistently 4-6hr chunks at many places in the bay area.
That source leads to here: http://www.foreignlaborcert.doleta.gov/performancedata.cfm#d...
From the linked article you can see links to:

> Band SDK Preview for Windows Phone

> Band SDK Preview for Android

> Band SDK Preview for iOS (coming soon)

I guess it depends on how much weight you put into cross platform.

Even if you just want to support one phone system you get access to a bunch of sensors that aren't currently slated for the iWatch.

> Use a range of sensors including heart rate, UV, accelerometer, gyroscope, and skin temperature, as well as fitness data, to design cutting-edge user experiences.
Yes, there is a standard for payments on the PIN pads. However, the real push for ISIS/Softcard was that they could do more than payments. They wanted to be able to push coupons through the PIN pads to the POS from their app. That was how they were planning to monetize the platform. The fees they would get from banks to hook into the system were minimal.

Even if the PIN pads could support coupons over NFC, most large scale POS software could not. I had experience last year trying to integrate ISIS/Softcard into a large retailer that was running IBM/Toshiba ACE POS software and ISIS/Softcard support wasn't even IBM/Toshiba's radar. Many large retailers run ACE (Kroger, Safeway, Costco, Macys, etc.).
New SecDef Ashton B Carter Has Banned PowerPoint
On the Art of Programming
Suggestion: write two or three posts, publish them at your regular interval and then re-launch.
The skill and spatial awareness of the vehicle necessary to cope with this sort of environment is far greater than that needed to deal with even the most demanding driving environments of America.

One day, I lucked out and found street parking near the convention center in Houston. I had to drive forwards then back into the unmarked space, which was obscured from view by the angle. I make sure to leave a good three feet of space from the car behind, and observe that there's space behind that car too. A few hours later, we come back to the car, and there's a woman in the car behind on the phone complaining about being "parked in."

(What's more, if you cranked up the stereotype dial when you imagine the scene, you'd be pretty accurate. No pickup truck, though. It was one of those Chrysler 300 style cars.) [heavy sigh]

EDIT: Contrast the above with what I observed in Sligo, Ireland, taking the bus to see some archaeological site. At this one bus stop on those twisty little roads, the mother and her child getting off the bus had to back up and flatten against the wall while the driver maneuvered out of this one bend in the road. If the driver had been wrong by a foot and a half -- and mind you, this is a full sized city bus -- he would've crushed them against the wall. Apparently, this was a regular occurrence!
Caveat - I live in Dublin. I understand people are a little more accepting of a couple drinks in the country.
To give a real example, CryptoCat managed to commit pinning suicide recently. They requested a pin in Chrome and then their CA's intermediate expired, meaning they had to reissue the cert .... but failed, because Chrome rejected the new cert. They had to wait for the next Chrome version to recover and basically had a multi-week outage because of it.

Pinning eliminates CA's by eliminating the agility they provide. Not inherently an awesome deal.
Great talk from forward thinker.
As an American, I don't drive drunk, and I don't find it painful. Drink somewhere close to home, call a cab. If I can get drunk at a bar, which will costs me $50+, I can certainly afford a $5-10 cab ride.

That said, I've heard that in Japan, it's the bar's responsibility to get you home safely. They take it very seriously, but you pay extra at the club to account for it.
Not at a simplistic level, no, but voltage you could derive from the discharge curve of a characterized battery (since we know fraction of charge remaining), and current could probably be approximated by looking at the rate of discharge.
https://news.ycombinator.com/item?id=8916103
Ideas:

(I'd be more interested in controlling my phone from the wrist)

Two-factor auth codes on the wrist instead of unlocking phone.

Beep my phone button (so I can find it when it's lost).

Record conversation. I have bad memory in long meetings.

Pager. A simple 'push this button to buzz the other person who is also wearing a band that you are linked to'. My wife needs me and sometimes I have headphones and can't hear her and don't see the phone light up.
I don't understand how this works.

I get this part: I enter my number. Your website calls my phone. I let it go to voicemail.

But how does it get the message off my voicemail? Presumably, it only records my "Hi, you've reached.. Please leave a message." voicemail message, rather than the ones stored in my voicemail box.

What am I missing?
Wow. What actually takes place in that time?
The Road to Wealth–Start an Unsexy Business
I was going to include that but I don't really know whether or not it's safer - inhaling cleaner but hotter vapor also strikes me as potentially problematic.
In fact: https://technet.microsoft.com/en-us/library/security/ms03-02... (notice the credit)
Former h1b here, now green card, soon citizen. I got a 0% raise when I got my green card. Have never heard of anything like this either amongst 10s of friends with h1b visas.
I'd argue that what people are doing at work is by definition their coworkers' business.
I will certainly re-post with an update as soon as I have more content, thanks for the feedback!
AngularJS: Custom debounce events
Ask HN: What metrics do you measure?
On a team level (as opposed to an individual developer level), what metrics do you like to use to measure and improve software development speed, quality, and efficiency?
What?

Google Wallet not working is completely on Google/the issuing bank. That is entirely a software limitation. If you try using the NFC on the phone and it tells you it's not available internationally, then there's clearly no hardware incompatibility, it's just Google not supporting international transactions.

Apple Pay not rolling out is also, similarly, because Apple is not ready to roll out in Canada, it's entirely software-based. I had my iPhone region set to Canada (I guess I never switched when I moved down) and I couldn't access the settings. Once I switched to US, bam, there it was. There have already been people who confirmed[1] that Apple Pay works perfectly fine in Canada.

NFC transactions are standardized, there is no "hardware won't work" because the entire point of the standard is that it will work. The incompatibilities are completely arbitrary, it's the respective companies not wanting to expand to Canada yet and using software to disable or limit the transactions based on transaction location.

[1]: http://www.itbusiness.ca/news/how-to-use-apple-pay-in-canada...
What "stops" them (to the extent that anything stops a government that is ignoring their own laws) is that the agreements CAs sign with browser/OS makers don't have any provision for issuing fake certs just because a government requested it or compromised the key.

That means if anyone found evidence that a CA was issuing bogus certs (such as one of those certs), that CA would be revoked and bankruptcy would follow soon after. The fact that they were just obeying a court order wouldn't be considered relevant by the browser makers, especially if it's an obscure and little used one.

There are other forms of punishment beyond outright revocation. A CA owned by the French government did something bad at some point (I forgot what), and instead of total revocation they were name constrained to .fr

But basically, forcing CAs to co-operate with you against the contracts they've signed is a very limited strategy. Most governments outside the US government can only do it once or twice before there are no more CAs left in their jurisdiction. Not to mention the legal mess that would result from a company beyond forced to commit suicide to help an intercept operation.
They're in different asset categories. E.g. if times get tough you can lay off people, but office space is generally leased for fairly long terms, and if you can't sublet for one reason or another....

And if the company is old enough they too often come out of different budgets.
NSA May Have Hacked Billions of SIM Cards
I usually do updates about once a week. If I need to install a new package, I'll usually refresh everything then as well. But occasionally it's longer than that. I just forget for a week or so, go on holiday, etc.

Most of the time, I come back, do an "Syu", and it's fine. Occasionally though, things go pear-shaped. Once or twice I've needed to manually fetch packages from one of the archive sites and manually copy it into pacman's cache directory to get things up and going again.
Brave words. Let us know what you come up with.
Nitpick - Infosys was fined because they were misusing the B-1 visa program, not the H1-B visa program. B-1 visas are the kind of visa that, e.g., a manager would need to visit the U.S. and meet in person with local personnel and customers. Apparently Infosys was bringing in foreign nationals on B-1's and they were doing software development in the U.S. The company denies wrongdoing, but they settled.
Java had been 1.x since 1996. Sun took to using the minor version as the everyday name - so 1.8 is Java 8 - and that seems to have worked okay so far.

I have no idea what Oracle or whoever will do if 2.0 ever does come out. But I doubt it ever will.
Only if you're a certified Engineer.

I studied Software Engineering, and I'm accredited by the Institute of Engineers in Australia.
Cross platform support. I'm assuming Apple's will only work with iOS devices. Windows will support Windows, Android, and iOS devices.

It's also less expensive, and from what I can tell, less bulky. You can also buy it, where as you cannot buy the Apple Watch.

Also, not sure about the various types of Apple watches, but it seems like the MS one is just one type, and does everything, where as the Apple watches each come with different features.

Honestly, I'm not entirely sure which watch comes with what on Apple's website. GPS isn't mentioned on the Watch or Sport Watch pages, but it is on the health-and-fitness page, so maybe it's only the sports watch with GPS? Not sure.

I guess the simple answer to your question:

> why would I buy a Microsoft Band? Why is it awesome?

It exists, and can do things now. Apple's Watch? Even Apple isn't clear on what it can do.

It's an odd place to be where Apple's product lineup is more confusing and less clear than Microsoft's. Reminds me of a certain commercial by a certain tech company mocking the difference choices for an OS. =)
Any manager of a technical group who says open plans result in a better product or service are either (1) lying because "open" is cheaper (more bodies per square foot / meter), or (2) completely ignorant of the concept of concentration and focus, and therefore not competent management.

My expectation is that the former is the most often case.
You're not missing anything. It's just recording the outgoing message. It can't get the messages left in the voicemail box.
There is No End
Last week we were watching "Annie" music videos on YouTube with my four year old and a commercial for a horror movie comes on.

It was a calamity. To stop the video, (which was being Chromecast onto my TV) I jumped to the couch to get my phone, waited for it to wake up, then spasmed on the screen trying to figure out how to exit or pause or whatever. It of course ignored me entirely. After all, the only reason I'd skip an ad is because I'm trying to bypass their ad-revenue. Le sigh.

My wife is meanwhile trying to get my daughter's attention innocuously so she won't watch a dead, rotting woman attack a little boy.

...

Needless to say, this change is welcome.
The post talks about "which hand is more likely to win". All I'm saying is that you don't care about how many hands you win, you care about how much money you win. It would be like measuring programmer productivity using number of lines of code written. This is obviously not an issue for someone who already understands poker, but if you didn't and you tried to use this table to scale your bets according to your overall likelihood of winning with a particular hand, then you wouldn't do well.
Yes and No. I was referring to the Chechen conflicts as well as the mini-war between Georgia and the South Ossetian separatists. Russia's involvement in the region specifically. But yes, you are correct in that there is no open warfare there... currently.
Nice move by MS for developers. Too bad you can't use the SDK on other platforms for development, OS X and linux.
Be Prepared: Journalists and Security Researchers
It's a good point. But don't mistake Flux, GraphQL, cursors, etc. with React.

React is just a great, fast way to interact with the DOM, with much less hoops than usual.

I think the community is still converging toward the proper way to deal with state. First it was passing callbacks, then the Flux pattern, and now there's talk of how GraphQL and Relay fit in.

And speaking of functional approaches, there are those of us who have been inspired by the Clojurescript community (who was in turn inspired by Haskell, as I understand it) and are interested in using cursors (similar to lens) to encapsulate state.
Scientists bring oxygen back to dead fjord
What have you gained going from Scala/Haskell/R to Javascript? What have you lost?
Algorithm Aversion: People Erroneously Avoid Algorithms After Seeing Them Err
As of 2001 is was a requirement to post the salary of H1-B employees. That how while at Lucent I found out the one who was if anything better at the particular job we were doing was earning $48K to my $80K :-(.
There's a piece of software out there called PokerTracker that allows a user to gather hand data for real-time statistical analysis. There are users out there who have very large databases (Billions of hands) and some users who will buy/sell/exchange these databases.
Meanwhile, Youtube still supports RC4. And SSL3! (WTF, guys!) I'm still waiting for them to jump on the bandwagon.

https://www.ssllabs.com/ssltest/analyze.html?d=r3---sn-jjpux...
I don't mean to be OT, but does anybody play online anymore? I paid my (cheap) rent in college playing on FullTilt and PokerStars, but the (unreasonable) gov't crackdown seems to have put an end to online play. Or is there a secret I'm not in on?
American employees are too expensive, and have too many rights. You can't compete with child slaves in China when you have a federal minimum wage and labor laws. They're even cheaper than robots.
well, you need authentication data in every request, which includes GET/DELETE/HEAD/OPTIONS requests with no payload. so either you use query strings (which suffers from the logging issue) or you use headers/cookies which some people argue isn't "REST"ful.
Or maybe they just realized that they were just putting good money after bad (because it wasn't succeeding) and decided to cut their losses and avoid the (small?) risk of alienating customers.
The 60,000 Word Rule
Also, Einstein's theories were a little bit more rigourous than "Well, the Luminiferous Aether sounds like bullshit to me"
Hot damn, that's exciting. I prefer the asm.js approach over PNaCl because it lets browsers gradually move over to the standard rather than forcing a flag day. This solves the big issue, namely parsing that big, hot mess of raw JS.

I hope we'll eventually see a proper bytecode spec with bidirectional assembly/disassembly w.r.t. JS (ie: more a transformation than an assembly spec) evolve from this effort, but it's obviously something that needs to happen after asm.js has had its time to bake.

This, of course, assumes that browsers don't get AOT/background compilation to the point where it's no longer necessary to consider a bytecode spec.
Windows Shapes the World's Languages
That position depends on the assumption that criminalization is benign. However, it's entirely possible that criminalization harms more lives and creates a greater strain on society than the act itself, as has very likely been the case with the broader criminalization of marijuana.

Defaulting to the position of criminalization regardless of the evidence, particularly in this context given the history and impact of existing marijuana policy, will likely perpetuate the creation of flawed policy.
Review: QuestOrganizer una app de vuelos para descubrir el mundo
I think you're in violent agreement with defen. You're probably so entrenched in Texas Hold'em thinking that it didn't even occur to you that a naive player may see this and think, "This hand is great! I'm going to bet it all!" defen is just pointing out that is a terrible idea, which I think you agree with, but it probably didn't occur to you that anyone could be so naive to even try.
I like this solution to union types. It uses sealed traits in a way I hadn't thought of before -- essentially inverted the usual strategy for using sealed traits to establish a sum type. Other strategies I've seen for union types involve implicit evidence, which this approach does not need.

I just wrote a blog post about error handling which shows where union types can be really useful (http://underscore.io/blog/posts/2015/02/23/designing-fail-fa...). I didn't really go into the use of union types in that post because the pre-existing techniques I knew of were all rather involved. This is simple enough that I think it's viable to use even in relatively unsophisticated code bases.
I've done a fair bit of driving (mostly in California) and never been through a roadblock. I've also never seen any booze busses or similar.

I've seen those videos too - are you saying it's unconstitutional to stop drivers to do a breathalyser?
What was your assertion, then? Because I made the same interpretation.

I think the answer to "do we know that?" was "yes, we know that."
I actually really like the sound of this, not because of the stated benefits (though those are nice), but because it sounds like this would actually create a really good upgrade path to implementing a proper bytecode into browsers.

I mean, with asm.js and the copious amounts of compile-to-Javascript languages available these days, Javascript is already becoming a de facto bytecode for the web. But it's always been a weird and uncomfortable hack done for the sake of backwards compatibility: a higher-level language hijacked to work as a compile target, simply because it's the only thing supported by browsers.

If projects like this Emterpreter catch on, though, it allows for a smooth path to proper bytecode: for backwards compatibility, you have the Emterpreter read and execute the bytecode, but in other, more modern browsers you have the browser execute the bytecode directly. I think this would be an overall better approach than what we have now.
Do you mean Interac Flash? Because that's EMV[1], just like Visa's PayWave, MC's PayPass, etc. They're all interchangeable, and they all use the same standard. There's no two radios needed. Plus, most NFC terminals in Canada were first built for PayWave/PayPass, so it would be stupid for them to try and go in a completely separate direction for debit NFC transactions.

[1]: http://www.interac.ca/en/press-releases/mobile-debit-eng under "About mobile Interac Flash"
(USA) I know many people who call themselves "engineers" who studied HTML and JavaScript and develop websites or web apps. I know many "engineers" who graduated from "Software Engineering" or "Computer Science" but have no governmental certification. Unlike Civil Engineering or other engineering disciplines, in the US software work is not as regulated, though I have seen regulations when dealing with Government work, calling for "engineers" to actually be accepted by a "official body of engineers."

Basically, in software in US, you can be an "engineer" and not get in trouble if you are not.
The only reason I haven't moved from Reflux to Rx or Bacon is because I want to see more about Falkor and Relay before deciding on a data management paradigm. Flux feels like a half measure on the way to something more robust; it works well enough, but I bet there's a better solution later this year.
Spooky action has been empirically demonstrated. https://arstechnica.com/science/2012/04/decision-to-entangle...