skysight-inc/HackerNews huggingface dataset:
GitBook co-founder here. We have a lot of non-english books actually: https://www.gitbook.com/explore, over a thousand in chinese alone.

In the upcoming 2.0.0 release, we've further improved internationalisation: https://github.com/GitbookIO/gitbook/tree/master/theme/i18n We automatically detect your book's language (or you can specify itself) and so then the build chain can automatically use translations for menu entries etc ... if available in your language.
Attic seems good. Its encryption makes me uneasy (https://github.com/jborg/attic/blob/master/attic/key.py), and I don't feel qualified to review it:

* use of pkbdf2(passphrase)[0:32] as encryption key?
* is AES correctly used? there are many pitfalls

I would be much more comfortable with it using gpg for encryption.
Added. I only included the cons, and of those only the lack of encryption. Most (or all) of the solutions in the list are CLI...
Self-adjustable difficulty. You might get some slack, that slowly fades away and you get closer and closer to the real thing. I believe it is doable with certain aspects.
I can see to not allow connections to be made to any host in the local network. That's fine. But blocking access to the loopback interface is IMHO going a bit too far as this was until now a very portable and secure way for websites to talk to locally installed helper applications.

Dropbox does this, Github for Mac does this (and incidentally, my own home-grown solution for reading barcode scanners does this too).

I really don't want to have to end up in a world where we have to write browser-specific solutions (the method recommended in the issue is chrome-specific) for these kind of things.
Does this use sidereal or tropical astrology? I think Hindu astrology uses the sidereal system. (Does it sound like I know what I'm talking about?)
This is so bad on Android 5 it's not even funny. When you enable that option it shows the whole list of notifications on the lock screen, each one of them has "sensitive information hidden" underneath, taking up lots of space. I know that sensitive information is hidden, I chose that option, no need to tell me for every single one of my notifications on the lockscreen!!!!
10 tips for better Pull Requests
Good point, and I'm no cryptologist either to find any flaws on it or to verify its robustness... Maybe someone in the community has the required knowledge about encryption to say something about this?
It's admittedly been 8-10 years since I was responsible for any serious backups so my experience is quite out of date, but Legato Networker is at the end of the day the best backup solution I've ever used. Yes it costs quite a bit of money and it's not trivial to set up, but once you've got it working it works so much better and easier than anything else I've ever used.
in the dropbox app. Feel free to extract the certificate and MITM connections to your local machine.
Blindly following Robert Martin's princinples is plain stupid in itself.
Martin often makes ridiculous statements based on his experience of not using
various things and techniques, so one has to filter out what actually makes
sense and when.
Things that we think of as programming and engineering will increasingly trickle down as digestible packages sold to masses. As has been happening for decades.
I'm always bothered that the SMSes for 2FA show up on the lock screen... could we not agree on a set of words that can block any message from appearing on the lock screen. Even just anything containing PIN or password would be a good start.
what I meant was that I think allowing CORS or a similar mechanism is probably enough, and breaking apps like Dropbox is not a great idea, even if there is a non standard mechanism to override it.
Quantum DJ (experimental quantum noise machine)
I guess I was wrong. I must have immediately looked at my settings after signup and turned that off.
Transparency in WordPress: Companies Who Publicly Share Income and Statistics
De-dupe, will only transfer blocks changed since last snapshot.

Performance, it's super damn fast. Because the ZFS snapshot itself is just a stream you can also compress it on the wire.

Flexibility. You don't need to send the snapshot to another ZFS server. You could just take the ZFS snapshot streams and store them on say S3 compressed and re-assemble them. This would take custom tooling but it's definitely possible.

You can restore super quickly to an older version if you haven't deleted the local snapshots.

Similar to above but if you don't want to restore (as in make said snapshot the current active dataset) you can create a writable clone of one of the snapshots to play with it before committing to a restore or just to "go back in time" and play with something.

As a bonus you also now have your data on ZFS which has tons of great benefits apart from the point in time snapshots.
This is, ahem, often necessary but insufficient to pass the must-be-at-least-this-social-status-to-rent bar.

So sometimes even paying someone isn't enough?
Then I'm not entirely sure I understand the point of having an SSL certificate in place to begin with?
Unfortunately, 'localhost' is not multiuser safe. So a better (cross browser!) alternative would be OK.
Yes indeed, I've found it quite useful as a reliable and easy to configure 'metabackup' system if you will.

That's correct, Backupninja can use Duplicity as a backend: https://labs.riseup.net/code/projects/backupninja/wiki/Dup
It will be nice if they really run under Linux. It would be sad if they run only on Ubuntu.
If you run it over ssh it is. Or do you mean stored in an encrypted way?
Cached version: http://webcache.googleusercontent.com/search?q=cache:eU8WfOm...
Virtual Reality Is Coming: But What Will Make It Worth Visiting?
Oneplus One 4.4.4, only Google.
Chromium Blog: Freezing Chrome for Ice Cream Sandwich
Wow how things have changed
I use and have been using Amanda Network Backup for ~5 years now, and am extremely happy with the results. Some of the highlights of my decision to use this tool include:

- Uses native OS tools (tar, gzip, gpg in my case) for the actual backups and restores, and includes the actual command used to create the archive in the header of the archive! You can use this to restore it without Amanda in the event of an emergency.

- Supports on-disk backups in a holding area for quick restores

- Supports S3 as a virtual tape library

- Supports vaulting (i.e. moving an archive from one tape library to another)

- Your choice of client, server, or no compression & encryption

- Highly scriptable

- Works over SSH, among other methods

- Catalog data is easily backed up itself via simple OS commands, and stored in S3.

The systems I backup are all in AWS, so this is ideal for me. I've frequently thought it would be ideal to adapt Amanda's script agents to creating EBS snapshots, but I simply haven't had the time. It's on my someday-maybe list. Remember to vault your backups to another region!

(Edits: formatting)
This could be integrated in to an SDK - Superstitious Developer Kit. Other tools in the chain could check for things like Friday the 13th, the occurrence of three consecutive sixes in your IP address, and tell you which oils to vaporise, incense to burn, crystals to wear, homoeopathic prophylactics to take, whether it's okay to build or deploy if you, your mother, or sister(s) are menstruating, and so on and so forth.
FYI: Citations \cite{} don't work in this example book
We've been using rsnapshot for years.

The offsite backups are on USB drives that are encrypted.

We just created a shell script to automate that, and run the database dumps prior to running rsnapshot.
Dr. Peter H. Diamandis — Intelligent Self-directed Evolution

https://www.youtube.com/watch?v=1H68gX_uCj4
oh the countless time I've wasted on Amanda - it's just too old now.
Would Y Combinator Invest in a Militia
"don't get stuck" reminds me of the feynman method of problem solving:

1. Write down the problem.
2. Think very hard.
3. Write down the answer.

Rich Hickey's Hammock Driven Development, https://www.youtube.com/watch?v=f84n5oFoZBc, is IMO very good for actually not getting stuck in a bad place problem solving.
Ask HN: Are travis-ci.org secure variables really secure?
It is often useful to have access to secret keys during the execution of the script running on travis-ci.org servers.

To do so, the travis doc [1] tells us to encrypt these keys with "travis encrypt SOMEVAR=secretvalue" and publishing the encrypted text in the public .travis.yml config file. The encrypted keys are decrypted by the travis-ci.org server during the build.

Lots of people seems to use them and travis-ci.org ends up with access to millions of secret keys. To me, centralizing such a big amount of secret data in the hands of such a small organization is a really bad idea but nobody seems to care.

Should we really trust the travis secure variables?

[1] http://docs.travis-ci.com/user/encryption-keys/
That is similar to what rsnapshot does.
This is an example of how expensive it is to be poor. Leaving cheaply (by getting cheaper accomodation) costs money. And many people can't afford to earn enough to break out of it.

(BTW Germany has expensive costs with moving. 3 to 6 months rent up front is very common)
I would love to see maven in the browser. Have each webapp serve a pom.xml listing the libs it uses along with exact versions and be done with this hell. The browser then checks if the lib is installed, if not, it goes through the user-specified maven repositories, then through the default ones and then through the webapp-specific ones searching for the artefact. Problem solved.
> The rental process can be quite complicated though. I can't even begin to imagine how to rent a flat directly without getting everything arranged through the company that hired you.

By finding a real estate agent that has experience with foreigners.

They will know which companies are happy renting to foreigners, and also guide you through the process.

And heck, if you're going to be paying agent fees (which in Tokyo, you probably are) you may as well get some value for the fees.

If anyone wants a recommendation for a real estate agent, email me at my HN username at gmail.
Yeah, that's my point. We're beyond the place in time where a single browser gets to dictate behavior like this.

I'm noticing a large uptick in "good engineering but terrible design and implementation choices in the name of security", and I wonder what's driving that.
This is quite apropos, as just last week I released a little language called 'bish' designed to overcome exactly this issue. It compiles to bash for portability, but has more modern and familiar syntax.

See https://github.com/tdenniston/bish for the repo and https://news.ycombinator.com/item?id=9166386 for some previous discussion.

The language is still brand new and under active development. It's not stable yet.
I honestly can't understand why distro makers like Cannonical don't have some out-of-the-box solution that works like Timemachine. Every step one has to configure himself can lead to a mistake and thus to a potential data loss. IMO an OS without a very-simple-to-set-up backup system that supports at the very least remote storage, incremental backup and restore during reinstallation, is incomplete.
20% royalty is really large
WhatsApp Voice Calling Available for All Android Users
Ask HN: How do I properly detect and exclude malicious user input?
We're just launching a new data store that will be populated with various kinds of user activity. How do I make sure that the data submitted to the datastore by the client, which is a browser in this use case, is not malicious?

Should I provide a nonce to the client and then validate that nonce when the data is submitted? If so, how should I implement this nonce function? Where can I find a peer reviewed nonce function implementation?

I think that determining malicious activity in general is a hard problem, and would involve detecting things such as:

rate of data submission
normal-ness of behavior
adherence to expected data structure

I expect that I will have to implement 1-3 on my own, but if I’m going to use a nonce I’d prefer not to roll my own.

Is a nonce worthwhile? If I’m just serving a nonce to a browser, that only requires that any malicious actor make HTTP requests and execute javascript, (as is possible with http://phantomjs.org/) extract the nonce, and then make a malicious request.

I’m out of my depth here, and would love some advice!
I noticed Twitter did something similar the other day. I was trying to login from my phone, and after two failed login attempts, I got an email with a confirmation code that I could enter into the Twitter app (on my android phone) to login. The email said I could also use this "code" in place of my password.

> We noticed that someone recently tried to sign in to your Twitter account (...)

> If this was you, confirm your identity by using this temporary code: (....)

> You can also enter this code where you would normally enter your password when you sign in.

I couldn't tell whether the email was sent because the second password attempt was successful or because it wasn't successful.
Most people are ignorant about the capabilities of their regime.

Police and secret service certainly have no qualms and little oversight when it comes to intercept a text message to access your accounts even in 'civilized' countries.
You cannot talk to non SSL connections from an SSL page.
Would it be comparable to BackupNinja?
Your startup’s most important conversation
Both securely transmited (ssh), stored in an encrypted way, but it's better if the encryption happens in the client, not in the server.
How to invest in Bitcoin? (as a long term play)
It's there to enable a connection from an https web app. Otherwise it would be blocked as mixed content (e.g. if you just used ws). Because everyone has access to the localhost key in the Dropbox app, Dropbox uses additional mutual authentication after establishing the wss (this is actually also because other websites may try to access the local daemon). The wss is only there to indicate to the browser that Dropbox really wants to establish a connection between their web app and the local daemon. It's a lot of hoops to jump through to make it work, but it's the best way of doing it.
Has anyone tried BareOS? - http://www.bareos.org

It has a modern looking web-ui too: http://www.bareos.org/en/bareos-webui.html
If Google keeps breaking web apps, users will move from Chrome anyway.
But this is the rental agent commission (Provision), there are several choices without provision

Also, it's the "cold rent" (without any additions)
I see a lot of discussion on the awkwardness and idiosyncrasies of shells like bash.... So this is a great time for a shameless plug! Last week I released a language called 'bish' (https://github.com/tdenniston/bish) which compiles to bash, but has none of the same syntactical weirdness. So the idea is: write and maintain your script in bish, but compile to bash and ship the bash version.

Here (https://news.ycombinator.com/item?id=9166386) is the previous discussion from last week.
This is very Pre-alpha, and it has had a number of iterations so far.

The requirements https://github.com/acutesoftware/AIKIF/blob/master/doc/AIKIF... give an overview on what the goals and intentions are.

Comments / feedback / requests appreciated
Yes but simpeler imho
I agree that Janes' subscribers are using their corporate credit cards to pay the subscription costs, but I also think that Gigaom had the potentials to walk into the same path.

Take a look at the first screenshot in the story[1], Om Malik describes the site in 2006 as a "broadband weblog". The kind of quality articles on Gigaom were not comparable with link-baity nature of TechCrunch/Mashable or Engadget/Gizmodo. They could have been the Janes of IT industry if they wanted to. Or at least be as affordable as the AviationWeek.

Notice someone on this thread is describing Gigaom as "boring", I take that as a compliment about the fact that the site was very industry-centric and devoid of click-baity stories.

[1] https://d262ilb51hltx0.cloudfront.net/max/896/1*ajvdVfFtBytF...
Yes I agree, and WSS already has that mechanism in place. A similar point was also raised in the issues thread but has not been responded to.
But then malware can exploit every user of Dropbox, for example, it doesn't even need their own certificate. And even the users wo don't have Dropbox are vulnerable throgh Dropbox's DNS entry.
maybe you want to add that in March, BTC appears to be moving up; $291 this morning, well off it's January low ; adoption seems to continue to accelerate;
An alternative, peer-to-peer name resolution mechanism will be in greater demand every year. Currently, DNS records are spoofed, proxied, blocked, and whatnot by the domain name registrars because of legal threats by big money.

There should be a way for people to search a particular server by name without being in cahoots with every other party who wants to get involved in it.
> Ironic that it's Chrome this time, the browser that started out as the champion of NOT breaking the web.

I don't think that was ever the message. Chrome has always been "the fastest browser" rather than anything else, and it has lead to (much-needed IMO) substantial performance improvements from the other camps.
Yes, the custom protocol scheme is also only really useful for doing something "once". That is, you can only issue one custom protocol request or so each time you load a web page, the browser blocks the rest to prevent spamming the user.
Fretsi Social Knowledge Platform for the Future(Fretsi.com)
Fretsi is gathering in one place courses, books, videos, events and news that match your interests.

It is the best place to gain knowledge daily without checking multiple websites or look through your RSS feed.

It also help you build a profile that express your skills and knowledge
Selfies. That sounds about right :)
YouTube 'planning subscription video-on-demand service'
Systems Theory; the greatest miss in general education.
Top 5 augmented reality tools for mobile: ARPA, ARLab, DroidAR, Metaio, Wikitude
Yes, (thomas) March is looking like a good entry point
10 Best Python Frameworks for Web Development
Dyson investing in battery tech to try to double battery life
Large display paradox resolved
OTOH it could speak to why so many black varieties of Carrots available today originate from Spain.
This argument has been shown to be wrong on many, many occasions.

Many users do not have a choice which browser they use, do not know they even have a choice or do not know how to exercise that choice i.e. download and install a competing browser. Finally you're then left with the massive problem of sites only working on certain browsers.
Ionic Moves to RC0
Since I've recently implemented a text editor based on a piece table myself, I spent some time researching where the concept was first used.

One of the first references (1974) I found was to the Bravo text editor for the Alto from Xerox PARC.

"Alto User’s Handbook"
http://research.microsoft.com/en-us/um/people/blampson/15a-A...

Then in 1985 a text editor called Lara by J. Gutknecht who in the following years joined Wirth to build Project Oberon whose text management system is also based on a piece table.

"Concepts of the text editor Lara"
http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.98....

If somebody as other, in particular earlier references, that would be interesting.

My recent implementation:
https://github.com/martanne/vis/blob/master/text.c
Seven Important #Bitcoin Stories – 3/16/15
RoboVM 1.0 Released – Commercial Licenses & A Look under the Hood
The implication is that these people's opinions of themselves are unwarranted by their actual accomplishments. It should be an easy test: how many TED speakers have followed through and implemented their ideas?
Cloud Computing Course Batch Starts 28th March Hurry Enroll NOw
There are already plenty of public DNS records which resolve to 127.0.0.1. They're offered as services. For example, 37Signals have a domain resolving to localhost.

Malware on a user's computer already has access to everything the user has.

Malware on a website would be blocked by the mutual authentication and origin checking that Dropbox do after establishing the WSS connection.

Malware in the form of a local daemon on a public computer where someone logs into Dropbox will not be able to authenticate with the web app.
10 Free IDs and Code Editors That Are Useful for Programmers
How Do Android Apps Compare with iOS Apps in Material Design?
Somehow, python3-pip escaped me. I feel silly.
http://www.jwz.org/doc/backups.html

i've been using the above as a really half assed way of doing backups on a server. using a nas instead of a usb hdd. very glad to benefit from the experience of others here.
Let me give you my perspective as a parent who fully intends to give every possible educational boost to his child.

I have a job, and lots of other obligations. Quite frankly, I don't really care if she wins the science fair or not. I suspect that if she decides to compete when the time comes, she'll have a good shot at it just because of the level of effort we put into education and the equipment we have around the house. The majority of my free time and money is spent on this, so we have a lot of unusual stuff.

It's easy to put that kind of effort into your own kids, because they live with you. They're around for all of your spare moments, and they can use equipment you have access to that demands close supervision. Now here's the part that's relevant to your comment - I'm also heavily involved in her school, trying to do as much as I can for all of the other kids who are interested (the topics are computer science, math, and robotics). I get to spend maybe two hours a week working on that, after my other obligations are taken care of. It's simply not possible for me to do more for the school, and even if I could the problem is concentration of resources. Given a certain budget (time and money) that I have available for this project, it's obvious that I can make a large difference for a small number of kids, or a small (forgettable) difference for a large number. Taken to the extreme, I can make an enormous difference for one kid (mine). No matter what I try to do, I'll never be able to make that kind of difference for even a small classroom full of kids, and certainly not a whole school. So I'm left with this choice: Do I spend my resources in a pursuit that's likely to be ultimately fruitless (i.e. trying to "raise all boats"), or do I spend it on something I have a very high chance of success with? Which of those is more wasteful? My answer is that I do the best I can for the school, but I feel no guilt about giving more to my own kids.

In the end, if my daughter ends up winning a science fair it's going to look exactly like a case of inherited privilege, and maybe that's what it is. That's not because I'm trying to hold down everyone else though, it's just a simple matter of logistics. If I could give that kind of boost to everyone, I'd do it in a heartbeat.
We're using bacula for backing up ~20 servers and VMs onto an LTO5 tape library. While it might be difficult to set up initially, that setup has now been running for over ten years (modulo changes accomodating new hardware).

It does provide lots of flexibility, though, you can restrict who gets to restore which files onto which servers, for example, or the ability to backup to different targets.

Regarding clock sync, that hasn't been a problem for ages:
“Note, on versions 1.33 or greater Bacula automatically makes the necessary adjustments to the time between the server and the client so that the times Bacula uses are synchronized.”
Anyone personally work on a DDS project is in actual production? I have never even seen one although I've worked in some of the industries where it is supposedly a success.
Huh, interesting, maybe it's a regional thing? In and around Delhi the default carrot is definitely purple (well, maybe closer to red, but definitely not orange).