skysight-inc/HackerNews huggingface dataset:
Thanks for spotting this Tim, I appreciate it. I've patched python-jwt and linked to your article. Please let me know if you file a CVE so I can link to it too.

The docs did say:

returns: ``(header, claims)`` if the token was verified successfully. The token must pass the following tests:
- Its signature must verify using the public key or its algorithm must be ``none``.

but passing the responsibility for checking header['alg'] to the caller was the wrong way round so thanks again!
For iOS, we have a pretty good patch to do it, yes.

We just have a weird but with M2TS files, but we will merge it during the next month. Expect it for 2.6.0
I've suffered from something very similar, other people have advised getting some exercise and you should definitely do that, I've found it helps.

You mention that you don't sleep very much and tried to sleep more for a few nights, try to continue that for a couple of weeks and see how you feel.

Something that often isn't mentioned with respect to sleep is consistency, go to bed at the same time and get up at the same time, every day - even on weekends. I personally struggle a lot with this one, but it has helped me a lot when I adhere to it. Even when I don't manage to go to bed at the same time on the weekend, I make sure I'm at most an hour late.

Good luck!
It seems like they never really gave react a real chance. although react is just a view render, to really get its red line performance requires going all in. I think it would have been worth it. a unidirectional data flow is worth the pain. It's so much easier to design something that only ever has to "rerender".

React isn't a magic bullet without using shouldComponentUpdate, and shouldComponentUpdate really works best with immutable data. Immutable data works best all in... See where this all in keeps going? Basically atom didn't wanr react to dictate their entire app and dictate how the plugins would all have to be rendered.
You're a free marketer who's against the limited liability corporation? That's a combination I've never encountered before. Start a business, risk losing your house.
The MITM framework was created by a separate company from the company that developed the specific piece of software. Just like you don't actually have to have a clue how a web server works to write a Rails app, the Superfish developers bought an off-the-shelf MITM framework and used it, which doesn't require much thought.
If resolution (and even that) and mostly chroma are similar, VLC should recycle. If it does not, please file a bug.

As for using Linux, try the OpenGL module, instead of the default.
You're going to have to set up split-DNS anyway if you want the records to resolve, right? Otherwise they would all NXDOMAIN.
> Canon buying it's own .canon gTLD and closing it down is a way to allow http://canon in the address bar of a browser.

It just occurred to me that—for advertising purposes—that would be longer than canon.com. They can't just plop the word "canon" at the bottom of their advertisements. Nobody would understand that to be a URL. So they would have to add the protocol to it:

http://canon

which is 3 characters longer than what they could do now:

canon.com

Not saying you're wrong about their intended use, it just struck me as ironic that having your own TLD would increase the size of your printed URL.
So far, no. Working on Mozilla technologies is usually very painful.
Analysis of the WH response to Warren's OpEd, http://www.foe.org/news/blog/2015-02-tall-tales-of-the-tpp

"The wealthy enjoy greater procedural rights. The U.S. Model BIT and the leaked TPP investment chapter provide greater procedural rights for foreign investors than U.S. investors enjoy. For example, they get to pick one of the arbitrators.

.. A separate “court” for foreign capital is established. Foreign investors would be able to bypass domestic courts and bring suit before special international tribunals designed to encourage international investment.

.. Tribunal arbitrators typically have a pro-corporate bias. Arbitrators in these cases are typically international commercial lawyers who may alternately serve as arbitrators one day and return as corporate counsel the next ..

.. Crippling awards of money damages chill regulatory initiatives and put pressure on governments to settle.

.. These models bear little resemblance to property rights and substantive due process protections in the U.S. Constitution or the legal traditions of other countries .."
And how about your users? I bet they don't mind their private information stolen, because they support your airbnb for dogs?

Will you give your little speech about laws and how it's illegal to hack your website and people shouldn't have done it?
The answer is certificate pinning. For example, it is impossible to MITM google services if you are using Chrome because the correct public keys are hardcoded in the browser itself.

If the site certificate is not pinned, you can use a 3rd party service hosted outside the MITM proxy to compare certificate fingerprints (such as https://www.grc.com/fingerprints.htm)
So what's the problem :)
Show HN: Realtime reflecting water surface (WebGL)
Afternoon tiredness could be a sign of low testosterone(assuming you are a man). I am know two people who have been diagnosed like this and that was a common symptom.

Of course it would be better to see a doctor then to ask a bunch of nerds on hacker news.
Too bad! I hope there will be better news once it comes out around August. :)
Only Facebook users are allowed to use 4&me. More than disappointing....
Elizabeth Warren? Isn't she the one that claimed to be native Anerican to get affirmative action benefits? We really want to elect someone that commits fraud? If George W. Claimed to be 1/12 black in order to get an affirmative action job, would you feel the same way?

I completely agree about Bush III though. He's a unprincipled fake. Rand Paul is a far better choice. Come to think of it, a Warren Paul race would actually be interesting and likely filled with more constructive disagreement on policy which would give voters a clear choice. A Clinton Bush race would be boring; they're two sides of the same coin.
I appreciate such work that people are working hard on, but how can this last long? Google was started with Ad-free too. The search will need money to run anyway. Have you figured out a better idea to get money without Ads?
Yes and no. For one, that's a big valuation. But the bigger issue is that I think many would agree that VRBO has way better inventory.
My understanding is that UberX is illegal in Thailand, but they've been doing it anyway as it's too difficult for police to enforce. If I was a Thai UberX driver, I might be thinking my life was significantly worse off...
Not overweight, but I was obese ten years ago. Not overeating remains overwhelmingly the biggest challenge in my life - one that I struggle with every day, and that I fail at as often as I succeed. On the other hand, I'm good at stuff that many other people find difficult.

What I learned from those many years of being fat is that my experience is not the same as everyone else's. Just because I find it simple to not drink doesn't mean it's the same for an alcoholic. Just because I'm a completer-finisher type doesn't mean it's easy for someone else to slog through writing their thesis. Just because being happy is a default state of mind for me, doesn't mean a depressive can just flip a switch like that.

I might, if asked, tell an alcoholic that they need to stop drinking, or a fat person that they need to lose weight, or a procrastinator that they need to finish their work - but I'll try not to be arrogant enough to tell them that the solution is obvious, that it's easy. How the hell would I know what's easy for them?
You can compare. Airbnb has more inherent risk to be disrupted than an existing hotel chain. It's illegal in places and some could argue that, while the sharing economy is the future, it won't be eternally brought to you the providers operating today.

And to answer your question: I used Airbnb once and would be very reluctant to use them again because of customer support issues, and I have thick skin that way.
It's ironic that Warren opposes this international trade court even when it supplants a government's own court, yet she supports the international criminal court which does the exact same thing.
Your view doesn't account for the fact that in computer security, offense overwhelmingly beats defense. Target. Sony. Home Depot. Nordstrom. Those are the ones you hear about, but what's scary are the number of company and government breaches that aren't made public. The cost of a zero-day is in the low to mid six figures.[1] If you are a juicy enough target, you will get hacked.

Obviously, this doesn't mean one should disregard security concerns. It's important to engage in good practices, to cultivate a combination of paranoia and attention to detail, to scrutinize suspicious behavior. But even if you do all of these things, modern computer systems have tons of surface area outside of your control. These days, it's unrealistic to demand perfect security from anyone, let alone small businesses.

Instead of being so uncompromising, I think it's better to ask businesses to explain their security policies and practices. Are administrators required to use multi-factor auth? Are backups encrypted, and if so, how? How are passwords hashed? Is data encrypted in transmission, and if so, how? Are server logs shipped to prevent tampering? Answering these questions (and others like them) can give security-conscious customers an idea of the business's expertise, and allow people to use products (or not) accordingly.

1. http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...
I think I'd take the $300m in profits on $600m (both wild guesses) in revenues and growing very rapidly with only a few thousand employees.
StorjVirtualDisk – A Storj Based Virtual Windows Drive
Hamming, on how anyone can make a mistake:

"I did not [discover] the FFT, though a book I had already published (1961)
shows I knew all the facts necessary, and could have done it easily! [...]
Think of my error! How much more stupid can anyone be?"
Thanks. What would be your preference and why? With our 1st version we want to learn from our users, so feedback is more than welcome :)
> Wow, you seem to have been way ahead of this project!

Not really, like I said the idea is similar but as fabulist pointed out [1], they have a whitelist approach so I'm not really sure that our idea could systematically break their system.

> It seems like this is a kind of equivalent to constant-time operations -- but constant-power operations?

You get the right intuition, but no. There are constant-power countermeasures but this is not it. You see, there are two types of side-channel countermeasures: palliatives and curatives. Palliative countermeasures, like the one we discussed in the paper I mentioned in my previous comment, attempt to make the attack more difficult by blurring the information the attacker has access to using randomness, but there is no theoretical foundation behind. By contrast, curative countermeasures aim at providing a leak-free implementation based on a security rationale.
There are two strategies to achieve this:
the first one is to make the leakage as decorrelated as possible from the sensitive data (masking),
and the second one is to make the leakage constant, irrespective of the sensitive data (balancing).

So your idea of constant-power exists, it is called balancing. I worked on this kind of countermeasures at assembly code level [2] if you are interested, and there are many other very interesting papers in the references to go through.

> Is that also relevant to defending against DPA?

Yes, it is mostly relevant against DPA. Actually constant-power operations are good against DPA, but absolutely not against PFP (what the linked post describes) since it makes it easier: it's always the same power trace!

> Should we think of the proposed technique as a new application of DPA? (Is Cryptography Research going to sue them?)

Since it seems to be done live I would rather say SPA (Simple Power Analysis) than DPA, but I guess the safer is to say that it is a (possibly new) application of the power side channel analysis.

(I don't know.)

[1] https://news.ycombinator.com/item?id=9122672

[2] http://pablo.rauzy.name/research.html#formaldpl
I've found that if someone's comment says "I stopped reading at X", the comment is more likely to respond to an unintentionally-constructed strawman than to the actual article content.
I guess this would solve the problem but it would also be slow because traversing the list via weak_ptr requires a conversion from weak_ptr to shared_ptr for every item.
It's not really ironic. Warren supports international human-rights law, but opposes "international" trade treaties that treat First World countries like Third World beggar-nations under IMF supervision. Simply put, establishing the sovereignty of human rights as a legally-enshrined standard is just plain morally superior to establishing the sovereignty of multinational financial and industrial corporations.
If you have $1b in high margin revs and are still doubling annually, you are easily worth $10-20b.
It does reduce your view of what's out there to some extent, giving seemingly undue bias to certain services or opinions.
Searched 'Google' got:

http://www.google.com/chromeframe/?redirect=true

As first result
Ask HN: When you think on success, who is the first person that comes to mind?
That would be so friggin amazing. Planet of the mice.
Wow. If I was trying to cause anticapitalist movements and revolutions in every First World country, I would have a genuinely hard time coming up with more effective measures than these.
"the rates we negotiated for rooms in Manhattan were much better than what you can get on Airbnb"

Which is why AirBnB's business is much better.
People used to say that Uber can't get that big since the taxi market in [city] is only x. And then Uber quickly grew its business in said city to 5x.

Exhibit A: http://fivethirtyeight.com/features/uber-isnt-worth-17-billi...
The app lives from user content =). We've just launched it yesterday night. So please feel free to spread the word and create many creative and interesting activities. We will do so as well of course.

Come see us also at the Launch Festival in SF, March 2-4. Happy to have a discussion and get your thoughts :) We provide original Haribo gummibears from Germany hehe.
> How do you visualize the power profile of a specific program (can you)? Could you use a simple power analyzer to potentially detect malware, or do you need something more refined?

I don't really know. Most power analysis side channel attacks focus on embedded systems where only the target code runs. But recently, TAU researchers did very cool stuff with power analysis on laptops running a normal OS [1] and their presentation at CHES last year was very impressive.

[1] http://www.tau.ac.il/~tromer/handsoff/
What makes PHP different from JS? Given the performance improvements realized in JS with JIT engines it seems the same benefits should be possible in PHP.
A 'lean' organisation is more likely to rely on a small number of individuals, or one person, to manage a large deployment. The devops approach gives a single good engineer a large amount of leverage in terms of deployment, but that will then bring a commensurate increase in pressure on that individual. I think it's a fair criticism of lean principles that it increases the pressure on individuals.

I agree most business owners wouldn't believe anything close to "some must die" - however, I do believe that inaction is almost as bad, and I do think mental health / wellness doesn't get anything like enough thought or attention. The harder you work your staff, and the more pressure you heap on them, the more you have to focus on them as individuals and support them better.
There are some good spots on EFnet.
For a late stage investor, 20% would be a huge return (i.e., a double in 4-5 years). Plus they have tremendous downside protection in the form of preferences so it's almost a no-brainer.
Elon Musk. If you read his Wikipedia article[1], it's amazing how much he's accomplished. Of course, he was lucky enough to be gifted with great intelligence, a strong work ethic, and a quite a bit of creativity. He's not someone to compare oneself to, but he is inspiring and I'm very glad he exists.

1. https://en.wikipedia.org/wiki/Elon_Musk
Apple against luxury
I'm going to say keep drinking caffeine, but not more than what you already consume.

Exercise. Aerobic > anaerobic.

Take breaks from the computer every now and then for long periods of time, perhaps on the weekend.

Change up your routine.

Make sure you have a good bed, good sleeping posture, and that you aren't interrupted while sleeping.
You're assuming there is a single perfect translation, or even a single perfect translation algorithm across all domains. I'd wager that translating legalese and translating prose will need completely different algorithms trained on them and in the latter case you won't find two translators that fully agree on the best way to translate a given text.
Zend Engine has been under it's own Zend license for 15 years I reckon. The web would probably look very different without Zend.
I'd like to add Welch's Practical Programming in Tcl and Tk [1]. I used it for learning TCL for an internship and it was not a bad experience for an undergrad.

[1] http://www.beedub.com/book/
I think traits are really confusing (dispatch by input AND output type), there's also trait inheritance, trait bounds, casting things to traits; add type inference to that, lifetime parameters and generics. You get things like

struct Foo<'a, P>
where P: std::ops::Neg + 'a,
<P as std::ops::Neg>::Output: 'a {
foo: &'a Bar<P>,
}

after further research this makes sense, of course, but looks like non-sense to anyone just trying to learn the language
You want a career and a baby? Who do you think you are?
Take road less travelled. 11 movie based on business person you must watch
How Small Business Loan Differs from a Conventional Business Loan?
Small business loans are non-traditional, unsecured, loans that don't require personal collateral for approval. They're typically short-term loans than the usual traditional loan and also have much greater approval rates.
>Isn't she the one that claimed to be native Anerican to get affirmative action benefits?

No [1]. (And keep in mind, I don't want her to run for President. She's far more useful as a policy wonk in the Senate.)

>Rand Paul is a far better choice.

Rand Paul? You mean the far-right anarcho-capitalist who considers one of the provisions of the Civil Rights Act unconstitutional[2], said that criticizing BP for trying to get out of paying for their own oil spill was "un-American ... criticism of business"[3], fought to defend tax-evaders who stash their money in Switzerland[4], and says that he's "not a firm believer in democracy"[5]?

Your post smells like you may be one of those people with a hobby of walking into places on the internet and trying to act like we all, for some strange reason, need to vote for the Pauls. While Clinton and Bush would indeed be two sides of the same coin, as was Obama vs Romney, Warren vs Paul would simply be a centrist vs an anarcho-capitalist, a distinction without a difference due to the present climate already being very firmly right-wing on economic matters[6] -- and that assumes Warren wouldn't be transformed into a Clintonite by the machinery of presidential campaigning.

[1] -- http://www.washingtonpost.com/blogs/fact-checker/post/rand-p...

[2] -- http://en.wikipedia.org/wiki/Elizabeth_Warren#Native_America...

[3] -- http://www.huffingtonpost.com/2010/05/21/rand-paul-obama-sou...

[4] -- http://www.politico.com/story/2014/03/rand-paul-tax-swiss-ba...

[5] -- http://nymag.com/daily/intelligencer/2013/06/why-rand-paul-d...

[6] -- http://www.politicalcompass.org/uselection2012
I agree - Fringe was amazing.
Perhaps you would know the answer to that if you had actually visited the link before commenting about it.
There isn't any choice in RC systems in presence of cycles, either weak pointers or a presence of cycle collector.

Anything else is unsafe, specially if the pointer is allowed to escape the RC object that contains it.

And this is one of the reasons why usually optimized GCs outperform RC solutions.

Unless approaches like affine types or counting elision are used, but those fail down in the presence of cycles, forcing the developers to use other approaches to represent cycles.
This sucks. I subscribe to Mega using PayPal and I love the service. I wish I didn't have to use Paypal. However, I don't live in the US, so my options are limited.

If Mega can't use PayPal, what can they use for processing international payments? What options are available for vendors of digital products who live outside the US?
But ~ is not a valid character in nicknames in the first place, according to RFC 1459, see https://tools.ietf.org/html/rfc1459#section-2.3.1:

<nick> ::= <letter> { <letter> | <number> | <special> }
<letter> ::= 'a' ... 'z' | 'A' ... 'Z'
<number> ::= '0' ... '9'
<special> ::= '-' | '[' | ']' | '\' | '`' | '^' | '{' | '}'
It's almost impossible to say anything definitive about line width on web pages because the experience depends so much on viewport aspect ratio, device rotation, and surrounding content.

The x-words-per-line standard derives from print, which has different traditions. Calling them rules is probably unwise. (See e.g. small column widths in newspaper and magazine layouts, vs paperback novel layouts, vs etc.)

Blog pages seem to have standardised on a single central column between a half and two thirds of the viewport width. Text sizing covers a huge range from ~12pt up to 16pt or even 18pt.

Modern product pages seem to have standardised on a selection of standard Bootstrap layouts, but with a lot of holdouts - e.g. Amazon - who do their own thing.

I'm not aware of any hard evidence about comprehension/retention metrics for these layouts. But they're very popular, and visitors don't seem to hate them.

There's actually more evidence for unexpected conversion rate increases from apparently insignificant changes to button positioning, icon colours, and such.

Much as I love beautiful typography, I think it's only a deal-breaker when it goes horribly wrong. For many sites, other design elements are likely more important.
Why reimplement a Search Engine from
scratch instead of contributing to lucene/solr/elastic search? did you add something new?
#mesopherehackweek to Focus on Services and Frameworks
I never went to University, but took my daughter for her interview at a large UK institution this week. I watched the students wander from lectures to the gym and coffee shop then to halls of residence all within strolling distance. Made me think this was the way I'd love to live.
No, in the UK being caught like this means a big fine, an long-term endorsement on your license and unpleasant side effects which include raised insurance premiums and not being able to get a hire car for several years afterwards. It IS actually a big deal. And it all has its roots in a bank card number changing unexpectedly.

And the point is, yes, consequences can be rather more damaging than having your Amazon Prime membership lapse.
I wish I could actually use the service by pointing a browser at this url.
You're artificially limiting yourself to iOS users.
btw from the website is not clear if query logs are preserved and/or shared with third parties.