skysight-inc/HackerNews huggingface dataset:
I ordered a XPS 13 in 2014 over the phone since there was a problem with checking out at the website at the time. I spent 15 hours (started logging hours after the 2nd) total fixing their mistake when I realized they didn't order me the developer edition. Those hours were also spent fixing the screw up of them sending it to the wrong address.

I did end up getting the laptop. It was pretty nice except I could hear an electrical hiss coming from the bottom of the laptop when the room was quiet.

I had a friend who had one and confirmed the sound was coming from his as well.

I sent the laptop back and spent another 2 hours with their "support" for that.

I'll never buy from Dell again.
I'm sure regret is also a part of it as well. "Why did I spend that money?" And of course, outright theft of services, where they watch/download whatever it is they're interested in and then cancel the charge.
The RAM footprints of most development tools on Linux are also less than on other operating systems, due to shared libraries and not just shipping every dependency bundled with binaries. A developer on OSX told me he was close to maxing out his 16gigs of RAM, blaming it on having to run 2 vagrant VMs simultaneously while working. While I wasn't able to establish a conclusive cause of his sizeable memory consumption (he was busy), I spun up 3 vagrant VMs of my own, simulated work, and opened/visited many more sites in Firefox to try to hog resources. I could hardly break 4 gigs of RAM used (out of 16), in Ubuntu 14.04. 8 gigs might not actually be so bad if you're doing development work using tools that aren't shipped as complete packages, but rather adhere to the unix philosophy.
Maybe it triggers the logic that allows (supposedly) user-added certs to override those pins? (Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections.)

Edit: I think that's the case. AGL's original announcement of pinning said:

"There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certificates. These certificates are signed by a root certificate that has to be manually installed on the client. Corporate MITM proxies may do this, several anti-virus/parental control products do this and debugging tools like Fiddler can also do this. Since we cannot break in these situations, user installed root CAs are given the authority to override pins. We don't believe that there will be any incompatibility issues."

https://www.imperialviolet.org/2011/05/04/pinning.html

If Chrome thinks that this was a "user installed root CA", it would have been allowed to override the pin. (Disclaimer: I haven't checked that this is right, I'm just using my recollection of how this could work according to AGL's account.)
Superfish: A History of Malware Complaints and International Surveillance
Seems like offering reserved parking spots with chargers would be a great way for a rental property to attract tenants.
Sigh... I'm on a Lenovo laptop. I opened the link and saw this in large type:

Do the test with Internet Explorer or Chrome first.

And I'm in... Firefox. I get the "probably not" image in both FF and Chrome now, but does that (unexplained) warning indicate that I've nullified the test?

I don't seem to have the Superfish program installed; but this is unnecessarily confusing.
I think it should be pointed out that bayesian's believe bayes theorem as a statement about plausibility of statements, so intuitions about an event space (which are obvious statements about sets) don't carry over to the general case.
“High-water mark” buffers
TL;DR

Create github profile, fill with projects you make in your spare time, create linked in, link github profile. Job offers will flow in like you've never seen and many times you won't even have to do a technical interview because your profile proves your worth.

This means:

- Write tests for your repositories

- Have repositories that display your expertise (whether in one language or many)

- Keep up on trends depending on what area you want to be in (devops, backend, frontend, full-stack, data science, growth, etc.)

- Show some marketing initiative, small number of stars / forks, by sending to various blogs.

It may seem like a lot, but it takes maybe an hour a day.
Comments are also very good at inventing their own fallacies and contradictions. If every comment section was as well thought-out as HN (which still has issues), I would be surprised by closed comments. But that's not how the internet is.
Chrome does do pinning, but ignores pins when the cert parent is a privately installed cert (because this is a "feature" used by many enterprises).

"""

Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor.

A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites.

'Data loss prevention' appliances, firewalls, content filters, and malware can use this feature to defeat the protections of key pinning.

"""

See: http://www.chromium.org/Home/chromium-security/security-faq#...
and the inverse is that there can be good intel gleaned by watching who else is trying to get in.
I originally discovered this issue a month ago when debugging my friend's Lenovo laptop. Neither chrome nor IE can render battle.net correctly because the HTML injection is not properly escaped. Since the problem persists after a fresh recovery, I guess it's from some pre-installed software. I almost reported it to FBI.
They own or co-own the patent(s). Last I checked they were still battling it out in court.

The relevant legislation that enabled Remote Deposit Capture (RDC) is the Check21 act, which you can learn about here: http://www.federalreserve.gov/paymentsystems/regcc-faq-check...

In theory, anyone can build a system to deposit checks via check images, but software/process patents are a (mostly bad) thing. :(
I still don't buy Apple is going to make a completely in-house EV. Historically, Apple only innovates in market categories in which the incumbents suck (usually through an order of magnitude improvement in the UI/UX). But Tesla doesn't suck...it's done a pretty damn good job. A partnership with Tesla makes more sense.
No man, definitely don't give up like this. Try going on CrunchBase/AngelList and looking for companies that recently got big funding rounds and apply to work there. The bar of admission will be lower because they're eager to spend. Try new job boards like Hired/White Truffle that aren't as flooded.

Have you asked your friends/college classmates/college professors/alumni relations department for leads? If you haven't, start doing that YESTERDAY.

Also see if you can talk to some recruiters: They can meet you, see your personality, and then socially massage the hiring manager in your favor before/after your interview.

Finally, worst case scenario, suck up the cash/time hit and hire a career/interviewing coach or go back to school and get a M.S. to punt this stressful situation into the future.

If you love programming and have a C.S. degree, you can have a job soon. Maybe if you're bad at interviewing you won't get the most prestigious one, but you'll get one.
I would have guessed closer to the world's GDP, maybe a few orders of magnitude more.
See you in a few weeks.
What happened to Zalando and Rocket Internet between September and October?
“Discuss latest changes to master before releasing”
I feel very silly -- thank you very much for the help!
Mt. Gox was not a ponzi scheme. It was a legitimate exchange business that became insolvent, and it was the users (not just investors) who got screwed.

Also, the term ponzi scheme get's used a lot in discussion about bitcoin, but many people do not know that it is a very specific type of scam. There have even been actual ponzi schemes involving bitcoins (not Mt. Gox). The people scammed in those were not insured because it was an investment, just as the people involved in the Maddoff scam were not insured. That is why it's disingenuous.
Would be interesting to see the same study performed on graduate students at various stages (pre-Masters to Masters, Masters to Candidacy, Candidacy to Doctorate, Doctorate to Post-Doctorate vs Doctorate to Industry).
If it happens to be a larger hotel, they could perhaps talk to the telcos about setting up femtocells inside the building.

On that note I was quite surprised that DESY [1] in Hamburg has done exactly that - had perfect cell reception ~30m underground (was taking a tour of HERA accelerator [2]).

[1] http://www.desy.de/index_eng.html
[2] http://www.desy.de/research/facilities__projects/hera/index_...
Congrats Max, great seeing your team do so well!
> You pay for cable TV but they sell you to advertisers.

That's not quite right. You pay your cable provider for television service. The cable provider pays networks for their content (the networks are the "suppliers" in this case). Some of those networks also collect payment from advertisers, but that advertising revenue probably wouldn't go to the cable company.
I'm in a similar boat and couldn't go back to a laptop with less than 16GB of RAM. To develop a mobile app for example, sometimes I need to be running a couple of Android emulators, an iOS simulator, Vagrant and VirtualBox for a local server, a couple of IDEs, a browser and more.
Good discussion! I just started using Elementary on an old spare system to try it out and I like it so far. Going to try all the cool utilities people have recommended. Thanks!
Yes! For those interested in a DIY project, I would add that "Permaculture: A Designer's Manual" [0] is arguably the reference for these techniques.

[0] http://www.amazon.com/Permaculture-Designers-Manual-Bill-Mol...
> encryption is necessary for there to be any meaning to authentication.

Could you elaborate on why that is the case? Do you perhaps mean cryptography rather than encryption?
Ah, That explains it. Thanks! And to semenko too.
It sounds like you really need to learn and switch gears, man.

Your family, friends and coworkers are what is real in your life. I know it's probably not your fault, but graduate school has this nasty effect of absorbing every bit of mental "energy" from the students. Your connection to the rest of your life gets starved and your identity becomes whatever you research.

Then, if you don't happen to be from the very lucky who get tenure, you get thrown to the wolves into a world that cannot and will not understand you. I could tell you of the time that I almost cry in my first (grossly overqualified) job because I could not figure out how to use the damned phone.

I am not telling you to leave behind whatever is you found in graduate school. You can always make a special place for it in your life. But the way forward is to make your life broader, by nurturing aspects and relationships that have been neglected so far (or creating new connections if some of the older ones got broken beyond repair).

At the end, you will become a happier and more interesting human being! :)
Komodia's own info says that it will generate an invalid certificate if the real certificate was invalid or untrusted "so it will not cause a security problem". They may be lying, but that page is fairly open about the way it works:

http://www.komodia.com/wiki/index.php?title=SSL_Digestor#Cer...
It sounds pretty pretentious (and to some extent, it definitely is), but I've really enjoyed reading and re-reading some books with Vladimir Nabokov's lecture notes[0] guiding my own.

I'd love to get my hands on that copy of "The Lion the Witch and the Wardrobe" with David Foster Wallace's annotations shown in the header image! Great book, great author.

[0]: http://www.amazon.com/Lectures-Literature-Vladimir-Nabokov/d...
No one is arguing that CL sucks, but that if you are going to re-skin the whole thing with learnings from modern languages, with features like string interpolation, then you might as well make the function names more intuitive while you are at it.

The specific example is talking about doing away with the format function in favor of the princ function. What is the argument against calling it print? No one is suggesting fprintf by the way.

You and the parent are also citing spoken languages, and certainly if you are a Chinese speaker then the difference between princ and print is going to be nominal to you. However, if you are a native English speaker, not so much. Really though, once you learn one programming language with standard library function names in English, then the second will be easier to learn if it uses similar names.

Back to the subject at hand, the case being made here is that most modern languages choose things a bit easier for the brain to parse; they aren't overly shortened, they aren't Hungarian notation, etc.. The reason for that is that it requires enough brain power to learn a new language, its structure, libraries and quirks without also having to memorize strange sequences of consonants.

Here is some code I wrote yesterday. Even if you never saw Ruby before in your life, don't know what blocks are, and have no idea what the array/enum functions are, you can probably figure out what this code is doing.

invoices = @organization.subscriptions.collect{|s| s.invoices}.flatten

current_invoices = invoices.select {|i| i.invoice_period_begin_date <= Date.today && i.invoice_period_end_date > Date.today }

current_paid_invoices, current_unpaid_invoices = current_invoices.partition {|i| i.paid?}

and THAT is why if you are designing a new language from scratch, you should strongly consider using intuitive function names.
People need free speech to speak freely. Your Wikileaks example is cherry-picking: it is not illegal to donate to Wikileaks. It might be illegal to donate to a drug cartel, or somebody like ISIS. Or to that police officer who wanted to give you a ticket. Or that government agent deciding who to give a big contract to.

I think think of far more cases where anonymous transactions are harmful than I can where they are beneficial.
Thanks for the catch! It should be corrected now
Bullshit. And this is not a matter of opinion or speculation. There is data and history. Take a look: http://imgur.com/FmpI0HY

That's the past year. The flat blue line around 0% is CAD vs USD. The crazy red line that's all over the place, swinging by as much as 100% in a matter of weeks, is CAD/BTC.
I went to Best Buy as well today and picked up a laptop to look into this further. The Superfish software is not properly passing the validation state of the public cert when it connects to a website like Bank of America as an example. There's no need to export their private and use it in a MitM transparent proxy. The software is simply not triggering appropriate warnings when provided an obviously fake certificate that has been generated in a way to bypass browser warnings. It's also not properly validating revoked certs. Both of these situations are very bad. Allowing any self-signed cert would lead me to believe that this could have easily been exploited in the wild without prior knowledge of this vulnerability.

I'm not going to provide a how-to guide on how to exploit users here. I have notified both Superfish and Lenovo of this issue and here's an example of the improper status pass through based on doing something that might be quite obvious to some:

This is what the browser should do when it encounters a self-signed cert delivered by an SSL/TLS MitM solution:

http://defaultstore.com/six.png

However, it's not doing this for this self-signed public cert:

http://defaultstore.com/four.png

Note both certs show "verify_fail." at the beginning and those who know how browser cryptography works will understand what has gone wrong with their implementation.
Apple launches repair program for longstanding 2011 MacBook Pro GPU problems
And the rationale:

"We deem this acceptable because the proxy or MITM can only be effective if the client machine has already been configured to trust the proxy’s issuing certificate"

I think that's fair, or at least it has traditionally been a fair assumption for most users.

The issue here is that your hardware vendor has compromised your machine, so that is no longer a fair assumption.
Run RPi Raspbian by Docker on X86 Linux
Run RPi Raspbian by Docker on X86 Linux, not QEMU ~~~

sudo apt-get install qemu-user-static

sudo docker run -it --rm -v /usr/bin/qemu-arm-static:/usr/bin/qemu-arm-static philipz/rpi-raspbian bash

https://drive.google.com/file/d/0B7KC8JBIhNVDUzNfcmJtQ2hFeHc/view?usp=sharing

https://drive.google.com/file/d/0B7KC8JBIhNVDY2l2Zl9lQXRGRkk/view?usp=sharing
It points to an interesting problem that, while browser vendors officially think that users ought to be notified when someone is using an intercepting proxy -- that it shouldn't be invisible to them -- when users aren't installing their own OS or configuring their own browser, it could be completely invisible in practice.

So the IT department-installed or OEM-installed cert is treated as "user-installed" by the pinning logic, and the user never actually gets warned.
Tried Inbox for week and felt like it was introducing more clutter than less! Switched back to Mailbox and the Mailbox for Mac beta and have no complaints, I like the simple clean interface and functionality. Just wish they made a darker theme.
I only just realized the Simon Peyton Jones (of GHC fame) works at Microsoft Research.
Because PRINT also exists, and doesn't do the same thing PRINC does.

http://www.lispworks.com/documentation/lw61/CLHS/Body/f_wr_p...
If it's solving problem that you don't know you have, I would consider it more creating opportunity.
That is good information, thanks for that.
> Do you perhaps mean "cryptography" rather than "encryption"?

That's true the poster said authentication of the server, if you sign every message cryptographically, you'll be able to detect message tampering. I should edit that.
Don't let it bother you. If you're performing at a high level, be confident in that instead of trying to tear others down.

Plenty of people code into the night because they just enjoy coding. Actively promoting a culture that puts a negative spin on that seems counterproductive.
Because clojure is garbage?

Also, Java/JVM suck ass, why would anyone willingly work with that whole mess?
I realize now I've been mixing up "incompetence" "ignorance" and "laziness". I used "ignorance" in the maxim in my first comment where it's actually "incompetence", and then discussed "laziness" in my followup comment. Sorry.

FWIW, I agree with you: I put thoughtlessness and callousness fall under the laziness umbrella.
Perhaps it's the Bounded Halting Problem which is known to be NPC: http://www.inf.ed.ac.uk/teaching/courses/cmc/lecture6.pdf
As other people have stated here, security is a justified means to an end to those who practice it.

I cringe a little bit whenever someone starts on the "first they came for..." monologue. Not because it isn't true, but because it first was used talking about the Jews in WWII Germany. You're effectively playing the Hitler card in a debate that isn't about Hitler.

The US was built in part by this type of security. Chances are things would be very different here if the security professionals over the years made decisions based on moral qualms.

I am playing the devils advocate, but when you look at the senate, it's hard to actually point a finger at the intelligence agencies. This is the world we have made, fear mongering hardly fits into this argument, and certainly adds nothing of substance.
As a web developer, I use VMs to have a completely isolated and reproducible development environment for each project. Vagrant [1] is a popular tool to achieve this, so take a look if you're interested :)

[1]: https://www.vagrantup.com/
I'm a lover of awful puns, and was actually surprised how few people I knew got it! I'm very glad you appreciate it, thanks!
Nope. Look at my reply to the parent. The Superfish solution is not properly passing the validation state of the public cert provided by the cert to the browser. As a result its fairly trivial to MitM HTTPS without need of the private when the Superfish software is installed. To be clear, it is absolutely worse to have Superfish installed than to have it removed.
If you find yourself annoyed by some aspects of Underscore, you might want to check out Lodash[1]. Lodash's API is a superset of Underscore, though you can create custom builds with only the parts you need. In general, Lodash performs better and has fewer bugs than Underscore. Unlike Underscore, Lodash has 100% test coverage. Also, Lodash has some handy things like _.cloneDeep(), and semantic versioning. That means your package.json can have "lodash": "3.x" in its dependencies without worrying about breakage.

For a more in-depth discussion of the differences between Lodash and Underscore, I recommend Ben McCormick's Underscore vs Lo-Dash[2].

1. https://lodash.com/

2. http://benmccormick.org/2014/11/12/underscore-vs-lodash/
No under this standard they can collect at crime scenes so long as they have a warrant to do so. They would be prohibited only from doing searches without a valid warrant meaning the warrant must be reasonable, specific, and signed by a judge. Searching a crime scene is both reasonable and specific, and getting a warrant is easier then ever today with most states adopting electronic warrant systems.
That was the main sell for me. Purchased!
Well, at least that requires two exploits/backdoors, instead of one.
Watches? You could argue that there were better MP3 players at the time of the iPod too. Historically speaking you're only looking back a decade.
People have a reasonable expectation of privacy. This means that the things they make public should be known to them to be made public. If I didn't intend to leave my DNA, then you shouldn't be able to use it unless you're investigating a related crime.

If I accidentally left my credit card on the ground, you would not be legally allowed to use it. I would have to have left it there on purpose.

The 'reasonable' is not about acquisition of information, but about the knowledge of the source. For instance, it is unreasonable for me to expect privacy in the trash bin, but not unreasonable for me to expect privacy in the bed of my truck.
Speed- The difference is after that 10 minutes, the transaction is settled. The money has moved. What you have with a credit card in 10 minutes is a promise that the money will move, possibly days or even weeks later.

The bitcoin can be moved again (spent by the receiver) after 10 minutes. Try that with money you received by a credit card payment.

This really is the fundamental difference of bitcoin- once the money has moved, it's really moved. It takes some time and thinking to appreciate how that opens things up quite a bit.
Redmine 3.0.0 and 2.6.2 released
In the examples I see nothing overly compelling which would justify fragmenting the mind share.

Some of them could possible be considered for alexandria https://common-lisp.net/project/alexandria/. Admittedly I am not sure how alive development is but it certainly would be worth breathing new life into as it is probably the most heavily used CL library.

As things like STM and lazy which Clojure has, they have been implemented at the library level for CL.

https://common-lisp.net/project/cl-stm/

The beauty about a Lisp is that you can easily add so much on top of the language that will feel as if it was always there. CLOS is a good example of this.

In the case of JVM with CLojure, and of course others will disagree, I don't think accessing the Java ecosystem is a good thing. The mindset there is monolith "Enterprise Solutions" "Inversion of Control frameworks" which invariable mean systems that are so complex the authors don't even understand them and lets write XML above all else.

Also if you want CL->Javascript; Parenscript.
So in 2020 people will have forgotten the etymology of print or format, rendering them nearly meaningless while princ, car and cdr endure?

That's rhetorical, you don't need to reply.
Show HN: FrontLog – work together