skysight-inc/HackerNews huggingface dataset:
It isn't cost of office space people are pointing out though, but cost of residential space. At least 30%, and more commonly 50% in SV/SF, of your company's salary compensation goes out to residential shelter payments. That's the low-hanging fruit to address if you want to reduce employee salaries.

Especially for a startup in like a stealth stage where the initial talent pool is already selected, and you don't really need all the touted soft benefits of the SV talent ecosystem when you are head-down in secretive development, it's advantageous to stay out of the high living expense metro areas. Living in flyover country during that period with the fully-communicated intent to the team that you will move to SV/high-COL-metro-area once you reach a specific level of financial success with specific commensurate salary adjustments for them, yields 15%+ salary cost savings from residential shelter cost differentials alone (plus other cost of living adjustments on top of that), and lets your initial employees plan ahead life events.

Now that startups are increasingly tapping the Millenial generation cohort for their talent, who statistically are already more indebted at their stage of life than previous generations, starting up in a very low cost of living area can be a bigger selling point for recruiting.
An explanation perhaps, but hardly an excuse.

LOOKING AT YOU, ALGOLIA SEARCH
Obviously the key theft made it easier, but remember that 2G/GSM still only uses 64-bit encryption keys even in A5/3 and GEA3.
Besides the fact the behemoths of corporate lobbying will prevent it, is there any reason to keep patents valid for 20 years, as they were 100 years ago? Shouldn't they be limited to, say, 3 or 5 years?

I think that would go a very long way to solving this horrendous mess that is the patent system.
It appeared in the press a week ago but Gemalto should have been informed earlier. Still seems like a small amount of time. It took Belgacom much longer to deal with it.
You won’t have that until someone takes the time to produce such a client.
RE2/J: Linear-time regular-expression matching for Java
The recent Py2 vs Py3 survey over Christmas suggests that approx. 32% of respondents write in Python 3 (increasing on last year), 68% write in Python 2 (decreasing on last year). Py3 usage is up approx. 12% on last year's survey. For personal projects Py2 and Py3 have roughly equal popularity: http://www.randalolson.com/2015/01/30/python-usage-survey-20...

At monthly PyDataLondon meetings I remind the audience to switch to Py3 (a few do each month) as Py2's sunset date is less than 5 years away now.
Retro Computer Puldin – the only Bulgarian 8-bit computer developed from scratch
I'm not a programmer so I was hoping somebody could answer this question for me, why did Moxie choose to italicise the word python in this sentence:

"Mailpile had to write 1400 lines of python code just to interface with a native GnuPG installation for basic operations, and it still isn’t rock solid."
Four to five years after the hacks happened, Gemalto says it was all not so bad, they really really checked this time and they have super duper server logs they grepped twice to be sure.

That's a bit unfair. Gemalto say:

- "The risk of the data being intercepted as it was shared with our customers was greatly reduced with the generalization of highly secure exchange processes that we had put in place well before 2010."

- "The report... also states that when operators used secure data exchange methods the interception technique did not work."

- "Gemalto has never sold SIM cards to four of the twelve operators listed in the documents, in particular to the Somali carrier where a reported 300,000 keys were stolen."

- "A list claiming to represent the locations of our personalization centers shows SIM card personalization centers in Japan, Colombia and Italy. However, we did not operate personalization centers in these countries at the time."

There's a lot of valid points in Gemalto's report, and it seems dishonest to write it off so pettily.
HotPy is Mark Shannon's research project, he's not making a 'new better Python for the masses', he's using it to test his assumptions about ways CPython could be improved. Ask him about it if you bump into him at a python conference!
> Phase 4 (the expert): You understand the design choices and motivations behind the language. You grok the philosophy of simplicity and composability.

In what way is Go code composable?
We prefer to use version control, and vendor libraries in our project instead. This is language-agnostic, and allows us to have repeatable builds without extra tools.

I've written up a tutorial about it using git-subtree:

https://github.com/jamesgraves/example-go-app
Agreed

The main issue for me is that I find it ridiculous to go to N teleconference interviews and then get turned down in person. I'm sure it's for some stupid reason like "all of our team like sports and you don't seem quite enthusiastic about it"

They push for you to "be honest" but that's only an excuse for turning you down. Give them the answers they want to hear and you'll be fine. Also the pressure of the moment is important.

(Also I would like to see their faces when my MBP's Facetime wouldn't connect - talk about a reliable software... not)
Best way is to use mmap MAP_ANONYMOUS.
Or with kernels 3.17+ memfd.
Thanks for your reply.

"The main problem is that you're completely missing the point." Sorry, can you be a little less confrontational?

"This is a complete non-topic." "...pay yourselves minimum wage if you can." And if I can't pay myself and several more founders? Would that make it a "Yes, topic" ?

I don't trust just one person's proclamations, specially when it makes no sense and there is no explanation, just a directive.

What sense does it make for all Founders depositing into start-up their post tax saving just so that start-up pay them back those money minus second income tax, minus second FICA & Unemployment insurance deductions for next 6-12 month?

That doesn't make sense to me. Because that prevents almost all tech startups to legally exist.

Thanks again for your comment.
While this has its points there is something missing.

Why were Tim's (and his group's) projects failing before they sdopted MDD? Were many of them new at the company? Did they have a bad manager that left as they started MDD?

If their new methology is bogus something else must have changed.
Pointer Events finalized, but Apple’s lack of support still a deal breaker
I guess I should clarify this example. I’m mostly fine with a global * { box-sizing: border-box; }, I’m only opposed to changing the box model randomly. The example illustrates a bad usage where changing the box model to get a full-width element is fundamentally wrong (since it’s the default behavior of block elements anyway).
Unless the NSA is one of those professional bodies, you can probably stay anonymous on the Internet successfully.
Same experience on my end for my first ultra distance race. However, feeling bloated is much better than bonking.
Oh, in that case I vehemently agree
Thanks, still didn't work for me in chrome incognito or firefox private, kept getting redirected to login sign up for linkedin. Maybe it's because i'm using a vpn?
Show HN: New userium.com (includes demo)
There's long articles and talks about the topic.
Check this one: https://vimeo.com/53221560
Invented here syndrome
I've found most western books written on the topic unsatisfying and barely hitting the basics of what's in eastern books. Have found it more effective to improvise one's own techniques using analogies and would recommend this to others. I think this is 'scientific' because no two minds are quite alike - so do the experiment and see what works for you.

The mind is much closer to computer science (with multiple processes) than biology and physics as currently understood. Think of how a computer shuts down cleanly (vs after corruption or out of memory) and then bootstraps clean (clarity). Or a tall office building that is lit all the way up, that is gradually shutting out its lights level by level. A physical analogy that is useful is of a train that is slowly coming to a halt. One cannot stop it suddenly as it has a lot of momentum, but one can reduce momentum gradually and let it coast to a halt. The mind is similar to the train - it does not really want to stop when awake - that's why it takes practice. Sometimes one of these images work, sometimes none do. I'm curious about other's experience as well.
It would be also prefferable to unlink just after /open/ call.

Wouldn't mkstemp("/dev/shm/tmp-XXXXXX") be enough. As strace tells /shm_open/ is just a wrapper for /open/ with /dev/shm/ prefix.
Can anyone elaborate on why it's supposedly only a problem for 2G? "If someone intercepted the encryption keys used in 3G or 4G SIMs they would not be able to connect to the networks and consequently would be unable to spy on communications." Why not? I feel like there is a "merely" missing from this sentence -- if so, what more than keys do they need to spy?

Are they basing this on the specific type of key discussed in the documents? I don't know a lot about it, but I'm inclined to believe there are valuable keys burned-in to 3G+ cards too.

I also wonder if there is a downgrade attack to force 2G, so that those keys are not completely worthless.
3 years is not enough time to commercialise in a lot of industries. Maybe would make sense in software, though software patents are silly to begin with
Inside the mind of Vladimir Putin
This is the most insanely strawman argument against python 2 I've ever read. I've written thousands of lines of unicode aware python 2 code.
How to Improve Customer Service with Social Media Monitoring
The article doesn't actually mention any details of the patents, or patent numbers. Anyone know what they relate to?
I'll be using pseudo code and skip over some technical details that are entirely irrelevant to this conversation in my answer. I hope I understood your question correctly and not answering something else entirely.

First, a functor doesn't go from A to F[B] but from F[A] to F[B]. A to F[B] looks suspiciously like something a monad does, a topic we don't want to get into.

Your example is a functor that maps unary functions to unary functions by composing them. It's a good if slightly complicated example: unary functions have two type parameters (A and B in A => B), while the slide's Functor only takes one. That is, you want to write a Functor[A => B], but you cannot, or at least not directly.

What you do is fix one of the parameters. You don't write a Functor for all unary functions, but a Functor for all unary functions whose parameter type is C (for concrete): Functor[C => A], where C is a concrete type and A the functor's type parameter.

This functor's map method takes an instance of (C => A), a function f: A => B, and yields a function C => B. The only non-pathological implementation of this is composition: C => A => B

What I just wrote makes it sound like you need to write a Functor implementation for all possible parameter types, but that luckily isn't true: writing a function that yields a Functor[C => A] for any given type parameter C is trivial. I'll put the code here just to show it is, but you don't really need to understand it:

// I know the C => ? isn't standard Scala, I'm using kind-projector syntax to make this readable.
implicit def functionFunctor[C] = new Functor[C => ?] {
override def map[A, B](fa: C => A)(f: A => B): C => B = f compose fa
}

To go back to your concrete example: you just need to get functionFunctor[X] and call map on (x => x * 0.5) to get your function from X to double. Note that some technical details are skipped (partial application, calling the binary function map with a single parameter), but I arbitrarily deem them irrelevant to my point.
I would gladly work at one. I have worked around people who did drugs with all the claims of how they were responsible. I will never subject myself to that again.

I did the piss test prior to my current employment and haven't in nearly twenty years since then. About the only chance it will happen is if you give clear signals your messed up.

Plus many industries are required by law to test. Considering the breadth of WalMart operations its likely they cross one of those laws and to avoid discrimination they test everyone.
How would he land in police in the first place? I understand most of the words but not the precise meaning :)
great summary!!!
You list plenty of specific problems with GPG the UI and GPG the "API" (though frankly the fact that mailpile would write 1400 lines of python that wrap GPG rather than taking one of the independent library implementations of RFC4880 and bringing it up to production quality makes them part of the problem). But none of those specific problems are problems with OpenPGP the protocol.
EnjoyCSS Update: Create and Share Your Personal Projects with Friends
Should You Plan a Final Social Media Post Before You Die?
Any encryption system has to exchange keys, and you can do it easily or securely, pick one. Failing the way you describe makes things cumbersome but does not compromise security.
I wonder how much gas is released in these events and the implications on global warming.
If you know anything about the subject matter of these submission, yes.
I couldn't find hardly any for which there isn't some prior art at least, sometimes a lot.
I won't even get into the fact that most of these are software or UX pattern patents.
Hopefully someone more knowledgable can weigh in, but as I understand the key stored on a 3G sim is more useful for authentication/identification rather than encryption.

3G/4G somehow uses random, short lived keys for encrypted communication, which change frequently enough to be a pain.

EDIT: It has been a while since I studied this, but I believe the shared key is used for trust - that this isn't a fake base station and the client is who they say they are. Then they use the equivalent of public key cryptography to establish short lived encryption keys. Stealing keys would probably enable a MitM only?
"Nighttime will be a different story. The brightness of Betelgeuse’s supernova is about the same as the quarter moon."

This will last maybe a couple of weeks, but we don't expect it for 100K years.
For Bitcoin to get mass adoption in Underbanked, it has to be more like M-Pesa
Creating a GPG alternative is hard. That's pretty much the only reason why it's still around. That, and the ubiquity of e-mail.

Sending encrypted/signed e-mail with GPG isn't hard when you're using things like Enigmail. Maybe the GUI could be a little friendlier, I don't know, but the encryption part isn't hard. Key management, now that's hard. Not just in terms of usage, but in terms of explaining it to new users.

On the one hand, both parties need to somehow exchange keys before they can communicate in a secure fashion. Doing this is hard, and if done wrong can leave you vulnerable to attack. That's why we verify key fingerprints. If there's an easy way to make this painless, I don't know it. Central authorities like what we've got with TLS/HTTPS are obviously a steaming pile of shite. Decentralized (like GPG) are difficult for users. What else is there? I don't know.
You can't. You are expected to vendor for dependable builds. This has upsides and downsides.

It does completely sidestep version dependencies hell and encourages you to think carefully about which dependencies you package. It does that by making you manually responsible for keeping dependencies up to date if you distribute other people's code with your own.

So, in answer to your original question, no go doesn't finally have a package manager with proper versioning (at least no official one). In practice, this is not as big an issue as you might think if you come from a language with such a package manager. In practice, I haven't really found it as much of a burden as I thought I might.
>why can't electronics reproduce the sound of a violin?

Well, if you're referring to synthesis based on physical modeling algorithms, it's possible, but it's just too complicated. A basic, not-too-expressive sound is easy to achieve, and already existed back in the days of the Ondes Martenot [1]. Getting the body's resonance is not the hardest part, you can just tweak it until you get something that you like.

But the most difficult part to reproduce about a violin is certainly the human and his interaction with the instrument. Sure, you could use a ribbon controller or one of the modern touch-based controllers [2], but it's still just a "spherical cow on a frictionless plane". Interaction between a string's vibration and the player's fingers is infinitely subtle.

Currently, synths based on sample banks are the best simulation of a violin that you can get. Just look up "violin VSTi" on your favorite search engine and you'll find many very realistic synths.

[1]: https://www.youtube.com/watch?v=Yy9UBjrUjwo#t=243

[2]: see the Persephone, the Hanken Continuum, and the ROLI Seaboard
I wondered about that too, not sure why this was downvoted.

Sorry for being OT, but maybe HN should recheck whether downvoting a comment just to express disagreement about a factual statement (as opposed to punishing bad or trollish ones) is conducive to a civil and constructive discourse here.
Firstly, I'm amazed that a large global corporation has put out a press release saying it has "reasonable grounds to believe that an operation by NSA and GCHQ probably happened." Wow.

That said, I wonder if Gemalto really had any other option than to say its keys weren't stolen. What might be the cost of replacing all affected SIM cards?
This is a good example of why formal verification is incredibly useful. I tried to invest some time in learning some of the proof verification languages and tools, but so far I wasn't too successful.

It looks like that to formulate a proof, I always have to rewrite the algorithm/problem first in the tool's language, which is often not easy. I could see myself making mistakes in writing the proof just as well as I do when I'm programming.

Proof validation is also tricky. Coq isn't fully automatic as I initially was expecting. I actually used "prover9" which is first-order only, but does automatic validation. I guess Coq is really useful when you need to understand the proof and interactive validation can guide you, whereas prover9 could help with automation.

The thing is, it's still too much work, even for seemingly simple algorithms, to write a proof in either system in order to improve on the current situation of unit testing (that is: if I wanted to get something with more intrinsic value than a test case).

Formally verified languages are nice, but for a gazillion of reasons you still need to verify what's running currently.
It's amazing how quickly the Aral dried up (well 90% of it).
Highly unlikely, given this is a product coming out of the Docker ecosystem.
Somewhat off-topic, but not too much: Are you the Jeff Bush that worked at Be for awhile? If so, you were in on my interview there. (For the sake of other readers, I got the job. But then Be went out of business seven months later and I got laid off, along with almost everybody else.)

This conversation is reminding me of why I washed out of the Bay Area high-tech scene. I was able to do it, but at too high a price. I'd rather work with slightly less smart people on much less shiny products, but living in a place where I can afford to buy a house, and with enough brainpower left over so that I don't have to live for my job.
How to Unlock Samsung Galaxy V Using Unlock Codes
Could someone explain to me the significance of having the keys as opposed to simply breaking A5/1 or A5/2 (Which is considered to be trivial)? Especially since A5/3 (which is also known to be insecure at least theoretically) can be downgraded to either of those or even A5/0?

Is the advantage solely that they don't need to intercept the traffic as a middleman to ask the target to downgrade?
> the best interview process is hiring someone as a consultant, and then converting them after a year or so

Unfortunately, this is also a "great" way to keep temp employees in constant limbo with the perm job as the carrot and stick. Usually, the temp job also leaves you with a lot less money (particularly because all the perks - insurance etc. - are reserved for proper employees) and, depending on the company, that's just all too attractive: A temp worker turning in work like a perm worker, always trying to "get there".
I also have trouble believing is that 3G/4G networks would not be affected. All of these protocols are based on symmetric cryptography, i.e. a shared secret between Operators and their SIM cards. Once you get the shared secret you have the keys to the kingdom.

Their protection is that many MNOs are using proprietary authentication algorithms, making it harder to scale global surveillance. But that applies equally to 2G/3G/4G.
What if any intermediate version is found to contain the violation of trusting trust? Every go maintainer has to build every version sequentially from that version to current version.
That sounds plausible. One problem I still see is that if $agency gets the authentication key, they can impersonate the user and possibly hijack their traffic. Maybe not as bad as passive decryption in some ways.
This statement from Gemalto seems quite naive considering the leaked documents state that the operations to obtain the private keys were successful.
They talk about the deployment of a "secure transfer system" BUT that will only help if that is the only time that data is ever transferred between two entities and assumes that the data will be kept securely.

The Ki database has to be distributed to so many places in and around the network that it isn't surprising that it is schlepped around using insecure means.

Of course in an ideal world the keys should never be accessible by a human, they should have been generated in a set of HSMs at the SIM manufacturer that are transferred physically to the network operator. In reality this doesn't happen as that takes time and money and is an overall logistical nightmare.

Mobile carriers use lots of professional services "experts" from the vendors they buy from, it is rare to have in-house engineers running and maintaining the systems as those tasks are usually outsourced.

Such engineers will have done a 4 week course with Nokia-Siemens-Networks, Huawei or Ericsson and they are sent out into the field with a crappy laptop and a few tools, they are just expensive "remote hands" without any real knowledge.

This is how it would play out from a 3rd level support/engineer back at Telco HQ -

In-house expert: Hi Mr Field Engineer, I need you to restore that HLR you are looking at, I can't reach it from here, and I need to send you a file securely to restore to that node, do you use PGP? Do you have the emergency encrypted USB stick with you?

Outsourced Engineer: PGP? I don't know how to program, isn't that for making web-sites? USB stick, yes I have a new one in my bag I bought for downloading movies.

In-house expert: No, that is PHP, don't worry about that for now, do you have any decryption software on your laptop?

Outsourced Engineer: No, but my laptop is already unlocked, I've typed in my account and password.

In-house expert: I have my boss screaming at me and the call-center is overloaded with complaints, do you know how to use SCP?

Outsourced Engineer: SCP?

In-house expert: OK, how about FTP, do you have an FTP client?

Outsourced Engineer: Yes, I've got that, I use it for sending firmware to Cisco routers.

In-house expert: No, not TFTP, FTP! Do you know what that is?

Outsourced Engineer: Huh?

In-house expert: OK, how about a corporate email account?

Outsourced Engineer: No, I'm working for "XYZ Solutions" and I'm on a probationary period, I have a hotmail account, does that help?

In-house export: OK, I suppose that will have to do, please just delete the email from hotmail and make sure you delete that file later from your PC.

Outsourced Engineer: OK, you mean just drag it to trash on this 4 year old Windows XP laptop I'm using?

sigh