skysight-inc/HackerNews huggingface dataset:
Look at HyperDex http://hyperdex.org/
Notion - Portland, OR - Full-stack Developer http://usenotion.com

Notion is a new company focused on becoming the central location for teams and companies to talk about data and make date-driven decisions.

You’re ready to be a key player at a startup using the latest in backend and front-end technologies to provide better insights for workers like us to make better decisions when building products, systems, and businesses. Come join our startup team with a track record of success to create your perfect future.

Here’s what we’re looking for:

Be a leader of product development. You should be able to work independently, as well as mentor more junior developers. You’ll play a critical role in defining timelines and development approaches.

Act as a voice of the customer and product. We believe design and engineering coexist side-by-side, so you’ll work closely with us on user experience, design, and technology – not just on technical feasibility, but creative possibilities. This is your opportunity to create an amazing product and see it grow beyond even what we can imagine.

A generalist that loves the details. You believe in writing maintainable backend and front-end performant code that is well organized. You believe in tests and testing. You see the web as just another client and want to push the limits on what’s possible.

Love a challenge. Embrace risk. We know startups aren’t for everyone, and so do you.

Requirements:

* Strong command of core backend (Ruby, Java, Scala, Python, Go) and front-end (HTML5, Javascript, JSON) technologies

* Confidence in designing APIs and interfaces

* Worked with REST APIs and comfortable with the whole request / response lifecycle.

* Strong understanding of JQuery and DOM manipulation techniques

* Experience developing complex applications

* Experience integrating data from third-party APIs

* Expert debugging skills

Here are some “nice-to-haves”:

* Exposure to true agile methodologies

* Familiarity with automated build tools and Continuous Integration

* Understanding of what it takes to implement an application with cross-browser support

Email us at jobs@usenotion.com
Pirate3D (Singapore) − Part time, REMOTE. Embedded, C++, Andoid, iOS, Mac & Windows native. Later VISA sponsorship to Singapore possible.

Our main product is the Buccaneer, a 3D printer designed to be affordable, sleek and user-friendly. We are currently ongoing a partial rewrite of our entire software stack −from native apps all the way down to the firmware−, and are looking to expand our −currently 5 programmers strong− software team, to help in this endeavor.

You will join our team over on GitHub, Slack and Google Hangout, and will be given the choice over which project you want to contribute to. Projects include the firmware −to control motors and sensors−, the backend −to give the printer intelligence and behavior−, the protocol −to interface between printer and smartphone over WiFi−, and the native-apps −for users to communicate with the printer. Firmware, backend and protocol are written in C++, while the native-apps are in the platforms' respective languages.

We will send you a printer to experiment with if it works out after a week or two.

If interested, send an email with your achievements and aspirations to Kai at contact@kaielvin.org
Happy to explain, please shoot me an email: andrew@kuhcoon.com thanks!
> I'm all for building fault tolerant systems, but the database being available ...

"the database"? Sure, if you've ruled out building systems that split state across multiple databases, filesystems, etc. However, what if you (for instance) want to isolate the user login system from the purchasing system, so that if someone discovers a DoS exploit against your login DB, users who are already logged in can still use your website and make purchases against your orders DB?

I ran into something similar back around 2005-6. My employer had a big problem with credit card thieves buying our inexpensive product in order to filter canceled CCs from usable CCs. All of the recommended open-source CAPTCHAs at the time expected that the code creating the CAPTCHA image and the code verifying the user's answer shared a filesystem and/or a database. For security reasons, our CC-processing machine was a bare minimum machine with bare minimum interface to the outside world.

So, what I did was make a security token that was tok = HMAC( key0, Concat( timestamp | 0x3F, ipv4addr | 0xFF ) ) ] . I then used seed = HMAC( key1, tok ) to seed a 31-bit linear feedback shift register that was used first to generate several base32 characters and then used to generate the positions of those characters and the psudorandom distortions of the CAPTCHA image. The main webserver then just created a form with hidden fields for tok and timestamp (plus all of the payment information) that made an HTTPS POST to the payment webserver. That way, each IP address would only get a new CAPTCHA every 32 seconds (so they couldn't just hammer us until we gave them some easy pseudorandom distortions), we had a verified timestamp for expiry (so we had a bound on how long we needed to keep successful answers in our anti-replay history), and users wouldn't get rejected if their ISP's NAT or DHCP setup changed their external IP within the same /24 between getting the CAPTCHA and submitting the purchase. The only pieces of shared state between the two servers were key0 and key1.

This wasn't JWT, but it illustrates a real world case where there was a strong need to separate state between two systems and have the client transmit the cryptographically authenticated data between the two systems.

As an aside, the system was built incrementally over the course of one evening. First stage deployment used dummy stub code for the anti-replay history database and sat back and waited for a thief to come along and hit us with a batch of several thousand stolen CCs. An IP from Virginia hit us a few times a second for a couple minutes with purchase POSTs missing the token and timestamp fields, all with different names and CCNs. After a pause of a couple of minutes, I started seeing a few successful purchases per second from that IP address, all using the same token and timestamp. I quickly manually banned that IP address and within 30 seconds saw several rejects per second from an IP address in England trying to use the cryptographic token tied to the /24 in Virginia. Then the attacker apparently decided it was easier to verify the stolen CCs somewhere else rather than try and OCR our CAPTCHA.
Still no SSL, so using redis-client still just spews your password out all over the internet.
Node.js Developers @ Car Throttle (https://www.carthrottle.com/jobs/) - Full-time, London UK

We're a funded media/tech startup based in London building a media platform product that connects publishers and communities. We run one of the largest automotive community websites online (http://www.carthrottle.com) and have a unique approach to building niche media properties.

We're hiring software engineers to join our small but growing product team as we re-architect our website and API to handle big traffic and rapid user growth.

Email jobs+engineering@carthrottle.com for more information or to apply.

Tech: Node.js, AWS, MySQL, Redis, nginx
Computing the hash of a known password is trivial, though—once you know one user used Passw0rd$, it's easy to check every user for that password, even if you have a salt, because the salt is not hidden. So you're just running n password checks in the number of users—admittedly, this is still n checks, but the difficulty of that pales in comparison to brute forcing passwords, and while it's strictly slower than just checking “is anyone else using exactly this”, it's not that much slower in the larger scheme of breaking a set of passwords.

At least that's my understanding... I am not a security expert! :)
Talis, Birmingham, UK.

EdTech 100% employee owned, SaaS software already in use in 50% of UK Universities, plus growing Oz, NZ, Malaysia, China and Norway.

Post-revenue and pre-profit (not for long). Every position comes with equity share via options scheme.

Various roles including dev, microservices architecture Node.JS, Java, AngularJS

Check out our ethos: http://careers.talis.com/
The Secret to Building Microservices
TIL there are people on HN that use windows phone! :)
You're right, authentication rates are low. But Moxies point of concern with regard to requiring a heavier CPU and memory commitment on the server is still valid, particularly when faced with malicious traffic.

You need to make sure your login system can handle malicious clients, brute-force attempts from individual IPs, or against particular accounts, dropping back to CAPCTHAs or some other means of resource control when things look bad. This isn't a particularly easy problem to solve, and if you do it incorrectly you open yourself and your users up to a denial-of-service.

IMHO, some of the new fancy password-based authentication protocols, like AugPAKE, which do hashing client-side, might ease this problem... but they're still stateful (SYN floods anyone?) and therefore still depend upon good DoS protection.

Edit: Oh poop, you're djb.
This. The problem is that in some cases, the legacy system is really messed up and making it unit testable is a big refactoring task on it's own.

In these cases, I try to write some functional tests first (such as calling restful endpoints and checking the response, or using a headless browser). Not great but much better than nothing. Any ideas on how to do it better?
>For the Raspberry Pi server we decided to write some Python using Tornado and instead of using an HTTP like API - HTTP and APIs built on it using REST etc are in my opinion often used too often when plain old sockets will do the job! - we decided to negotiate a socket using WebSockets and then communicate messages as small as possible over that socket so that the latency was negligible.

Not that it matters much which tool you use for a job like this, but this part doesn't really make sense. A WebSocket handshake is at least as big as this sort of REST request would have been, and if you wanted to keep everyone connected a basic TCP socket would work even better. They write how they had to implement a heartbeat on top of WebSockets, which seems like more work than the message framing on a TCP socket would have been.

Neat project just the same, though.
They were building Rage at the time. I'm sure the budget for that game was like 5x that of D3.
Shit runs late, cost blooms.
Lots of 90's era twenty person shops had trouble dealing with increasing costs.
To have fun on April Fools' Day we wanted to build something useful and funny: we created a new XKCD-like password generator that can use different languages dictionaries and show a picture for each generated term by searching Google Images. We had a lot of laughs playing around with Italian and English passwords and we hope you'll have as fun with this as we did!
An unknown force is pulling the Milky Way towards it at 14M mph
Zenefits - https://www.zenefits.com - San Francisco, CA and Vancouver, BC

Full stack developers, VISA

Zenefits is the fastest growing SaaS company in history. We are looking for engineers who can take a concept from inception to market. The process is extremely autonomous, with little to no, management. You are the PM, tester & developer, building full-stack, who coordinates with our in-house designers.

We also need someone who is excited to innovate an archaic industry.
Trello (New York City / REMOTE)

Current Openings

•IT Engineer

•Account Executive

•Site Reliability Engineering Team Lead

•Windows Mobile Developer

•ECMAScript Developer

https://trello.com/jobs

Private offices. Free, catered lunch. Top-of-the-line benefits.

Born out of Fog Creek Software, Trello was built to be an awesome place to work. We treat employees like royalty.
Microservices in Erlang
London, United Kingdom - Osper - https://osper.com

We provide a real prepaid debit card for young people, aged 8-18, so they can make independent decisions with money: online, in shops, at cash machines, and abroad. Thousands of families have already signed up to the service and we will be growing enormously this year.

But we not only help young people buy Legos and save for bicycles - we are building an awesome technology team that eliminates legacy code, keeps the bug rate tiny, and stays small and joyful. We are doing this by adopting techniques like pair programming, test-driven development, and continuous deployment. You can read more about our plan to be awesome on our tech blog http://tech.osper.io. We want to meet and work with smart technical folks of all sorts - from server-side devs to sysadmins, mobile coders to testers, security analysts to data crunchers - but especially quality and product experts who obsessed with automated and exploratory testing for mobile devices.

We are willing to arrange relocation to London for the right candidates. Sorry, we're not ready to take on remote team members at this time.
RINSE - https://www.rinse.com - Santa Monica, CA and San Francisco, CA

Rinse is a technology-enabled dry cleaning and laundry delivery service. We've been growing our service at an exponential rate for the past two years, and our customers love us! We're expanding to westside Los Angeles, and are hiring aggressively.

We're hiring a General Manager for our Los Angeles office. This is very similar to a startup CEO role, as you'll be responsible for all aspects of our Los Angeles operation, from hiring and managing a large team, to developing business relationships with our vendors, to understanding our customers and their needs. This is a huge opportunity for the right candidate! http://bit.ly/rinse_LA_GM

We're also aggressively hiring drivers for our San Francisco and Los Angeles offices. Our drivers work a few nights a week in the evening. To be eligible, you must have your own car, a smart phone, and a clean driving record. This is a good opportunity for students or anyone else looking to earn some extra money as a side gig while exploring the city and meeting people.

Interested? Email jobs <at> rinse.com or me directly at sam <at> rinse.com
The Perfect Birth Control for Men Is Here. Why Can't We Use It?
Hodor Lang by Hummingbird Tech

http://www.hodor-lang.org/
SEEKING WORK

Location: San Francisco Bay Area, California (CA), USA

Remote: yes

Technologies: python (Django, Flask, Google App Engine), JavaScript (Backbone, Marionette, jQuery, requirejs, grunt, bower, angular), SQL (MySQL, PostgreSQL), AWS (Amazon Web Services), UNIX terminal, full stack, front-end, back-end, HTML5 and CSS3, junior product management, basic UX, UI. Microservices, Test Driven Design (Test Driven Development).

Résumé/CV: https://www.linkedin.com/in/paulcraciunoiu/

Email: paul [at] craciunoiu {dot} net

---------------

Freelance independent consultant looking for web or software work. I get things done and pick up new projects quickly. Great communicator (for estimates, handling vague specs, open-ended work), knows startup chaos (former CTO and co-founder). Passionate about doing good, building great products, and quality work.

Satisfaction guaranteed.

I'm also able to join forces with a UX/UI designer whom I often work with in a team. We are an incredibly productive pair.
I think if the most efficient way to attack the hashes is to buy the same hardware you use to process logins than in some sense you've already won. It's where the attacker can buy GPUs or program an FPGA and dollar for dollar make orders of magnitude more guesses per second than you do verifications per second that you want to avoid.

To the larger point, I do agree that some of this starts to look to be a bit of security theater. If a user picks a laughably weak password, and the server is completely compromised, it doesn't much matter what password storage scheme you used, and on the other hand if the user picks a great password, especially if he never reuses it, the consequences of losing that hash is limited.
.work is cheaper, except for some "premium" words.

I bought shall.work for 2 usd, although I admit I only bought it to use the mail it©shall,work for testing purposes.
Appcelerator Titanium Mobile Developer @ FreshTemp (https://freshtemp.com) - Part time, Remote, Pittsburgh, PA

We are a fast growing combination software and hardware company that monitors temperature for food safety in restaurants. We're well funded.

Our mobile application is currently used by restaurant owners and employees to take spot temperatures required for corporate or legal compliance. We've proven that customers want this, and now we need to take it to the next level by adding non-temperature question and answer capabilities and improving the UI.

You would be improving upon our existing codebase to add functionality and make improvements. Commits will go through stringent code review until your advisor has ensured your code has met all requirements.

You have strong JavaScript skills.

You are fluent in English.

Details

This is a part-time job with flexible hours.
We'll have at least 15 hours of work per week for you for the foreseeable future.
You have to work at least a few of those hours between 10am and 10pm US Eastern time.
You must be legally permitted to work in the US.
You'll be paid as a contractor with a 1099.

To apply, fill out our Google Form here: http://goo.gl/forms/s7pFMEfk7t
>You can't trust anybody except for open source repositories.

That is patently false.

Established profitable companies in a market with multiple competitors usually do not fuck with their customers, if they charge up-front for their product/service.

On the other hand, companies that give away stuff for "free" have to find unique ways to pay the bills (be it hosting fees, or hardware costs, or developer time, etc). In recent years the most common way is to create some way to essentially trick people into clicking ads.

Open Source repositories have not found any long term sustainable method to get compensated for their hosting fees or hardware costs. At the moment, they are run on donations - mostly from commercial vendors, universities and the like. At some point in the future, lets say if 500 million desktop users all start using those repositories, there will come a time when that cost is going to stick out on a balance sheet. I hope that they figure out a way to get paid for their efforts by then.
>I know you don't want to be competing with the nice Indian fellow, but don't spin your protectionism as somehow being for his benefit.

As I said, I am pro-immigration. I would have no problem him coming over here with a green card and I am for extending the number of green cards given out.

>You simply want to confine him to (American style) poverty to protect your paycheck.

It seems your assmptions about me are quite mistaken.
Jukely | https://www.jukely.com/ | New York, NY | Frontend, Backend, Mobile (iOS/Android), Design

Jukely helps music lovers discover concerts, friends to go with, and provides access to unlimited shows for $25/mo. We’re a small team of designers, engineers, and concert promoters creating boldly-designed products (https://unlimited.jukely.com) for concert goers.

If you're an engineer (backend, frontend, mobile) or designer that loves music—get in touch!

Apply at https://www.jukely.com/jobs.
p.s. no April fools here. 1 year ago I released HyperLogLog, today 3.0.0, just to contrast with some shit done this April fool lameness.

https://twitter.com/antirez/status/583279481453936640
I wonder what John Camack's current thoughts are on C++ design. I rarely use inheritance and usually have either inlined functions or functions that operate on arrays or many objects at a time. I also use templates when they deal with straight type substitution (including functions). I am though starting to get familiar with extern templates to be able keep compile times down.
T-Mobile Pets Unleashed https://www.youtube.com/watch?v=_Kj-4F8pWfk
Hmm I still don't understand, but thanks for replying to my (downvoted) honest question.

If all you have is a hash and know the password you still dont know if it's

md5sum('salt:' + password) or

md5sum(password + '-salt') or

md5sum('salt+' + password + '=salt')

etc

I suppose you'd need to brute force a large key space and look for any results which contain your known password. Does that sound right?
It's not impossible, but Android phones need to do more - they run not just a web stack but also the Android Java stack - and they have not optimized for the low end, as much so far.
Python is extensively used in DevOps/ system-administration ... usually its the go to language but rarely mentioned because you're supposed the know it by default to perform those jobs.
> Care to tell me what are the other practical avenues for people to immigrate to US if they are not a noble laureate or an olympic gold medalist ?

Not be from a country for which the applicable immigrant visa categories are overloaded (IIRC, China, India are the big overloaded categories for employer-based categories; and Mexico, the Phillipines, and India again for family-based categories) and be qualified for either family-based or employer-based immigration.

Or, qualify for a number of the other dual-intent non-immigrant visas besides the H-1B, such as the H-4, or the L, E non-immigrant visas.

The H-1B is just one dual-intent non-immigrant visa category, its not even the main way for people who aren't noble laureate or Olympic gold medalists (or the broader group who qualify under the O and P non-immigrant visa categories that would seem to apply to those two groups) to immigrate.
SEEKING WORK - Remote

I engineer marketing outcomes, I call it interactive content marketing.

You and I would work together to come up with the best solution for your business and I'll build it.

What is it that I build? Free microsites/tools for your audience that would drive targeted leads to your main offering.

Here are some examples of what I mean:

- Hubspot's marketing grader. A simple tool that lets a user type in their website and their email and get a report of what they can improve.

- Buffer's Pablo app lets you create and share images on social media with your text overlaid on it. Pablo drives tons of targeted traffic (people that do social media marketing) to Buffer.

Ready for a better form of content marketing?

Contact: christopher.bui [@] folkrobots.com
I go to Wikipedia nowadays to find a project's official URL. Not foolproof but better than Google.
Very cool that you replied, you are one of the founders, right?

Are people directly exposing Couchbase/CouchDB at the frontend? A lot of people poo-pooed that idea (NEVER EXPOSE DB TO THE INTARWEBS!), which was the neatest idea, no matter how dangerous, when I first heard of it a few years ago. Are people doing this?

Thanks for your mobile SDKs. I wanted to learn Erlang for CouchDB, and I saw your mobile clients and thought that, and PouchDB, would make for a mean confluence of rapid desktop web and mobile app development.
On https://github.com/antirez/redis/tree/3.0 branch, it shows
"This branch is 1004 commits ahead, 1252 commits behind unstable".
Could work in many cases. I've always liked this concept for email in a similar way. I'm already in my email all day on all of my devices and utilize it in a number of ways. Let me stay in my email and you don't have to entice me to your site or app to actively use your service. I like the way http://www.statlogger.com has integrated both SMS and email in this way. I'm trying something similar with http://tuduli.com (email-based to do list). SMS could work, too.