skysight-inc/HackerNews huggingface dataset:
The standard reply here is that none of those bad foundations is a good justification for someone else (e.g. your neighbor, your homeowner's association, or the state government) to take your stuff, unless they can actually show that whose stuff it ought to be.

If I could hypothetically follow the "chain of legitimacy" for, say, your car all the way back to the original exertion of labor on natural resources...

https://en.wikipedia.org/wiki/Labor_theory_of_property

...I'd likely find some sort of illegal activity at some point. But this doesn't mean I can take your car by force and give it charity.
I have quite literally used "Left at the spot where there is usually a cow grazing next to a bus stop" to tell people to find my house.
Showing 404 to hide the existence of a resource is specifically called out as a suitable use in the RFCs:

The 404 (Not Found) status code indicates that the origin
server did not find a current representation for the target
resource or is not willing to disclose that one exists.

http://tools.ietf.org/html/rfc7231#section-6.5.4
Voxel8 | Software Engineer | Cambridge MA (Greater Boston Area)| www.voxel8.co

At Voxel8 we are developing a new 3D printer that is capable producing 3D electronics on the desktop. We just announced our new 3D electronics printer at CES this year, where it was very well received. Fast Company named us one of the 9 best ideas at CES.

I am looking for a software developer that has experience developing CAD software. We are using web gl to develop new CAD software that allows our users to design circuits in 3D. One of the perks of course will be that you can use our printer to design and print whatever you want!

Technologies we are using:

* Javascript/HTML/CSS/WebGL

* Docker

* Python/numpy/scipy

* Julia

* Microcontrollers/Arduinos (C/C++)

I am looking for people who are:

* Self directed

* Able to propose and meet their own milestones

* Work with end users of our machine

Voxel8 is the hottest new startup in 3D printing and we are changing the way electronics are manufactured. If you want to be a part of our incredible team, please email me at jack@voxel8.co
Let Srinivas stay!

Srinivas is just as smart and highly-skilled as the other engineers you could hire. However, he's a lot more motivated, because if he has trouble getting or keeping contract work, he'll be deported.

Got a tedious job? Srinivas will take it and never, ever complain. Need someone with an obscure skillset in an remote geographical location? Srini will relocate there within a week. Will he be able to find a nice apartment on such short notice? Don't worry, that's Srini's problem. Srini is so helpful and eager to please that during the interview, when you ask him what he's looking for in his next position, he will be genuinely confused, as if to say, "Why would that matter?"

You see, Srinivas' employer has purchased one of a handful of lucrative H1-B visas, which it then rents out to people like Srinivas in exchange for as much as half of his salary. There are a lot more people like Srini than there are available visas, and Srini knows it. That keeps Srini in line - which helps your bottom line.

But now a bunch of coddled US tech workers (with their "standing desks" and "dual monitors" and "work-life balance") are trying to kick poor Srini out of the country. Why? Who knows - they're probably racist.

So let's stand up for the little guy, by helping a handful of the nation's most powerful and well-connected corporations lobby for legislation that will save them millions of dollars. Let Srinivas stay!
Android vs. iOS permissions
The rise and fall of Japan's PC-98
Does openstreetmaps have a proper cross-platform phone app with turn by turn instructions while you are driving that works well - and does it have a good majority of costa rican roads?
What do you mean? Sparta.
IMHO the most important non-technical thing for Open Source is evangelism. Talking them up on wikis, encouraging your employer to use them, helping answer questions on open forums... Relative to commercial projects, technical resources aren't the limiting factor.
I agree, of course there is nothing stopping you from resetting if and when you want to, and on your own schedule. That's not a reason not to run a hash on the input token. I think there's no possible reason not to run 'token = sha256(token)'.

> In most cases that's a low-cost operation

But resetting API tokens is not necessarily low cost, as it's literally pulling the plug on all your persistent connections, and requiring manual intervention to bring them back online. There are many cases where you can't simply pull the plug on all your clients.

Also, as a byproduct it enforces all sorts of best practices, like ensuring the token is just a token, and doesn't have data piggybacking on it.
There's actually weird disincentives to building built right into the tax code:

http://www.forbes.com/sites/anthonynitti/2013/12/31/tax-geek...

It's about capital-gains tax vs income tax. Because the rates are dramatically different and the case law is so convoluted, people who hold land as an investment don't touch it.

If they touch it in the wrong way, the sale of that land is taxed as regular income instead of capital-gains. In America, regular income tax is DOUBLE capital-gains tax.
Show HN: Foe, a lightweight auth library for Clojure web apps
Google is putting substantial resources behind Cloud Platform: https://cloud.google.com/

But in general, yes, there are serious capital costs and economies of scale with infrastructure, so there won't be a lot of small competitors in this space.
Rita – The social drawing app
Amazon Echo
I received my amazon echo today, after peeling back the rubber on the foot I discovered 2 Debug Ports labeled B and C,

B [1] [2] [3] [4] [5]

[6] [7] [8] [9]

C [1] [2] [3] [4]

[5] [6] [7] [8] [9]

Grounds: B-1, B-6, B-8, C-3

I am going to make a connector and hook up my logic analyzer later on. But it is positive for hacking, my suspicion is that one goes to the Texas Instruments DM3725CUS100 Digital Media Processor and one goes to the SanDisk SDIN7DP2-4G 4 GB iNAND Ultra Flash Memory and they use this to program and test it.
Cassandra when done correctly, will scale linearly[0]. As will most other Dynamo type data stores.

Additionally, there are many other large databases (Hadoop, etc) that will scale linearly. While it may not be ideal for this use case, but a proper multi-master setup with many read slaves in either PostgreSQL or MySQL could be described as being able to scale linearly to some unspecified extremely large upper limit (see work done previously at Yahoo, Google, Amazon, et al). Much of this also depends on what you define as scaling linearly (are you looking for linear scaling for memory, reads, writes, storage, latency, costs, etc?).

Real time stats for pages, sites, hosts for a shared annotation system across browsers doesn't mesh well with your initial condition of "privacy concerns."

[0] http://techblog.netflix.com/2011/11/benchmarking-cassandra-s...
Looks like it just downloads/uploads plain data to the web service. I thought that in this age of internet technologies a web site would be enough.
One other dependency often forgotten is on the Makefile itself. This way if the Makefile changes, everything gets rebuilt:

DEPS = Makefile
%.o: %.c $(DEPS)
$(CC) $(CCFLAGS) -o $@ -c $<
whats the purpose of a desktop app for this?
Most definitely not April fools, just terrible timing. Source: I was Nebula's CTO.
Also Indiana, for its eateries may now legally refuse to serve customers that use machine learning for religous reasons.
Yes! Thank you. Accessibility is much easier if you plan for it from the start and it's very important to have accessible content.
I replied to another one of your comments with the exact same links, but I'll to it again here so it doesn't get buried in a huge comment thread.

While all those facts may be true nationally, in California, agricultural irrigation is by far the highest use of water.

Taking one of the sources from the HuffPo article (http://pubs.usgs.gov/circ/1405/pdf/circ1405.pdf), 188 million gal/day used in livestock in California, while a staggering 23,100 million gal/day is used for irrigation. It's not even remotely close. The problem is irrigation, the article is correct, and meat has little to do with it in California.
Well hey there! That was a great talk!
Something I haven't seen mentioned yet: For a developer to become involved with a new project requires some substantial cognitive overhead to learn what files matter, the terminology and basic flow of data through the codebase, etc. There may be interest in having someone with your skillset create "Introduction to Hacking Foo" presentations. For example, if someone offered to tell me the main components of how django works in an easily accessible style with plenty of helpful visual accompaniments, I'd be thrilled. While I can figure those things out, that figuring takes time/reading/effort and anything that could potentially reduce that effort is just great IMO

If your content is good enough and you're passionate about such an idea, I could see a series of these introduction videos/slides/blog posts being a really popular series
>Also, taxation is meant for government to run to do its primary duties and not affect the market forces.

I don't think this is the case for every tax. Look at the different carbon tax systems. This is a tax to try to drive the market towards greener solutions/products.

I guess an argument could be made that the tax is a way to quantify damage to the environment done and the money it's going to take to repair it, but I don't think that's the way most people see it.
Have you looked into the lazyload attr? https://dvcs.w3.org/hg/webperf/raw-file/tip/specs/ResourcePr...
CMake generates Makefiles (and other build system files on other systems). If something doesn't work, you can either fiddle with it without understanding what you're doing, or you can look at the Makefile and see what went wrong...

I prefer to just use plain Makefiles, they're easier to fix and "make correct" than anything else. For me, I guess. make is weird, but more minimal than cmake. (cmake is HUGE. autotools are a lot weirder than make. considering the alternatives, I actually like make...)
Motd, display big words on a big screen
But it doesn't matter if they keep hitting their service with a list of known emails and then sending bogus passwords, 5 times per email per host.
MDNS misconfiguration (my first public disclosure)
Thank you.

You write that there is an argument to be made for discouraging sitting on land as a real estate investment, without using it to benefit the neighborhood that it sits in.

Let's say that you are right, that there is such an argument to be made. In other words, the neighborhood in which the property resides would benefit from some improvements to the property in question.

In this case, why should the affected parties not try to work together to accomplish it?

For example, if I own a vacant lot in the middle of a neighborhood, and my neighbors want to use the land for a park, I'd be happy to discuss selling some or all of it to a neighborhood association.

On the other hand, if the neighbors are going to get together and petition the local city council to confiscate my property, say through eminent domain, that seems like an unreasonable intrusion on property rights.

I understand that people want things. However, I think we'd all be better off it we sought to work things out through voluntary cooperation and free trade – in an environment where individual rights are respected – rather than empowering politicians to pass laws that grant special favors to certain groups.
Um. YES, YES, YES, YES.

I have a list of small to microscopic projects that need this kind of thing. I am totally a Linux nerd, that's not great for lots of end users.
Got Rick Rolled... :(
Location: Seattle
Remote: Yes
Willing to relocate: Yes
Technologies: Ruby, Node.js, Python, Bash/ZSH, HTML/CSS/JavaScript, Linux/Unix system administration, SQL Amazon Web Services, Hadoop, MapReduce, Git
Resume: https://crc.io/resume/
Email: hackernews@crc.io

About: Technical Product Manager with experience in UX Design, Analytics, ETL, Web Analytics, Data Visualization, Digital Marketing, Online Ad Serving Technologies, Site Personalization and Measurement

Clickable resume link: https://crc.io/resume
More helpful data would be 1) How many founders end up raising $1B and 2) how much equity each ended up with. Let's use historical data to support 28% after x rounds.
Location: Seattle
Remote: Yes
Willing to relocate: Yes
Technologies: Ruby, Node.js, Python, Bash/ZSH, HTML/CSS/JavaScript, Linux/Unix system administration, SQL Amazon Web Services, Hadoop, MapReduce, Git
Resume: https://crc.io/resume/
Email: hackernews@crc.io

About: Technical Product Manager with experience in UX Design, Analytics, ETL, Web Analytics, Data Visualization, Digital Marketing, Online Ad Serving Technologies, Site Personalization and Measurement
> The salt (unknown to the attacker)

The salt is generally known to the attacker. The point of the salt is that it’s unique for each password hash, making it impossible to run crack attempts on every password at the same time; for a password hash to be checked, the salt has to be retrieved. This means they’re usually stored together and therefore also compromised together; keeping them apart is rarely useful (kind of like peppers, which is what you might be thinking of; they’re per-application rather than per-hash, and their purpose is to be unknown to the attacker, which is equivalent to encrypting things with a per-application key).
YES.

How do I contact you?

My profiles:

https://github.com/webmaven

https://www.linkedin.com/in/michaelbernstein.com

Hopefully you're open to remote candidates from non-traditional backgrounds.
Some basic SRE principles
(author here)

I'm working on text editor with real-time spelling correction where `innerText`-like retrieval has to happen quite frequently; it's what pushed me to research the state of affairs with `innerText` in the first place.

It pains me that we don't have a quick, native way of doing that; that I have to traverse the DOM manually instead — a horribly, horribly slow process — essentially writing what `innerText` was supposed to be.

I guess HTML/DOM were never really designed to be good at a task like this. The closest thing is Selection/Ranges API but it's still way behind in terms of performance.

The fact that there's `innerText` in some browser sarcastically starring in your face ("I'm here, but you can't really use me") just makes this so much crappier.

I guess a lot of this boils down to performance. It's certainly possible to emulate `innerText` but we can't possibly match native speed. And speed is crucial for any kind of real-time editing that needs to have a quick access to plain text version of an element.
Sorry I can't release the tool yet, the suits at my 9-5 are making a stink about my independent research going through their approval process because they contractually own my soul something.
This was a great presentation. It gave me some practical things to change to increase the security of my WP install.

That said, seeing the ease with which WP can be hacked makes me once again question whether to switch to a simpler blog platform that poses a smaller attack surface. Anybody have experience with / recommendations of such systems?
Totally what I was thinking
What about curl, wget, httpie?

Or how about lynx or w3m?

Plenty of people want to utilize CLIs and it's definitely beneficial when learning to program to get as much experience on a command line as possible.
Instacart - San Francisco, CA (VISA)

Instacart is building the best way for people anywhere in the world to shop for groceries. Every day, we solve incredibly hard problems to create an experience for our customers that is absolutely magical. We are funded by renowned investors like Sequoia Capital, Andreessen Horowitz, Khosla Ventures, SV Angel, and Y Combinator. We raised our $210M Series C three months ago and we are growing like crazy. It's a fun time to join - I'm loving every day.

https://www.instacart.com/jobs/engineering

Senior Software Engineer
Data Analyst - Product
Data Scientist
Senior Android Engineer
Senior iOS Engineer
Senior Product Manager
Site Reliability Engineer

If you're interested in joining the team or just want to chat about what it's like to work here, email me at rahil@instacart.com.

Thanks for reading!
Looking into it more, Taleb's only clear connection to the paper or biology in general is an old grudge against Dawkins. He's a fascinating economist but it looks like he's out of his element here.

It looks like a complete non-story scientifically. However, Taleb's now wandered into a new neighborhood, he's insulted people, he's bragged about his math skills, and he's borderline demanded a paradigm shift in a field he has no background in. This might still get interesting considering A) Dawkins' response might be classic and B) some mathematical physicist might wander by and take issue with a group of scientists being disrespected by an economist who thinks he's good at math.
Extremely confusing website, are the exercises somewhere on the website or do I need to download an application or are the exercises on Github or what?

The screenshots make it look like CodeAcademy with messages/comments, but I can't find the exercises anywhere.
They don't like fair use, but it is not clear fair use protections could be legislated away without a court overturning any such clause with a first amendment argument. If that were to happen, foreign corporations could sue the US for damages, and win, but no other legal remedy would be available -- they could not stop the fair use from continuing. Maybe they could sue again the following year.
Except he's not right. ARPANET was one aspect of what would become the Internet. The public Internet as we know it is an amalgamation of technologies which were developed by the U.S., Great Britain, and France. You really can't claim that the U.S. invented the Internet.
This is an excellent idea, thanks!

Currently off my bike due to ill health but will suggest it to the cycling club.
Grouber from Groupon: http://www.groupon.com/pages/grouber
Could you explain what you mean by "locks you in"?
> There is one thing that I think is often omitted. A lot of user use trivial passwords and they reuse them. These users' passwords will fall essentially no matter what you do because making the check so slow that a dictionary attack with a couple thousand very common passwords becomes impractical is itself borderline impractical.

Sure. This is something I touched on very briefly near the end of the post. Password re-use is a huge problem and could easily be an blogpost of its own.

> On the other hand strong passwords will withstand an attack even if they are hashed with plain MD5 or SHA1 - at least right now, there are already some serious collision attacks.

For some value of 'strong' sure. If you're password is long enough, random enough, and of a broad character set then yes, an md5() of that may well be beyond the reach of most attackers. But that's not the sort of password most people, even security conscious people, choose. A preimage against MD5 would quickly change this too, and that's a risky gamble.

> The user group really benefiting from strong password hashing schemes is the one between the two mentioned extremes.

The best we can do is make attacker costs a function of the password that the user has chosen. If someone makes their password 'password' there's no degree of magic that's going to help. Mostly, the benefit comes if/when disclosure occurs and there's an active incident response effort.

> So if you really want to protect all your users and use simple password authentication you have to enforce strong passwords policies which is itself not trivial and will definitely badly annoy some users.

It's not a zero sum game. When a breach occurs, the rough points in time are something like:

1) Attacker compromises digests (let's just assume all are obtained in an instant, rather than exfiltrated over time)
2) Attacker recovers 1 password
3) Attacker recovers n passwords
4) Attacker recovers all passwords

Our goal isn't to eliminate these steps except hopefully the extreme of 4. Rather, it's to increase the time between 2 and 4, and make sure 3 is closer to 2 than 4.

On the other side of the coin, there's a few points in time:

a) Victim org. realizes digests have been compromised.
b) Some credentials valid at 1 are made invalid.
c) All credentials valid at 1 are made invalid.

If you accept my previous point that at some extreme there's nothing that can be done to prevent brute force, then you should also see that storing passwords in this fashion isn't meant to be a perfect defense. By minimizing the number of compromised accounts at a given point in time, we can maximize the benefits of our response. We can notify users and force resets, invalidating some set of credentials before they're recovered. We want b and c to be closer in time to 2 than 4, and minimize the value of n when we get there.
You can choose either Cmder by itself or a bundled installer that includes msysgit. I set my default "new console" to that bundled bash and things work pretty great. Start + "cmd" and I'm at a bash prompt in a fairly nice console emulator.

Most people install a better terminal emulator to replace OS X's default terminal app anyway, so we're all installing something to get a nice experience. I really haven't missed any of my Mac's command line friendliness when on my Windows machines using Cmder.

Chocolatey is a fairly popular apt/yum equivalent on Windows. Most anything built on Node, like npm, bower, or jspm, works fine too.

Could things be better? Sure. Every platform has room for improvement in areas. As a developer primarily using Windows here, my day-to-day experience just doesn't seem anywhere nearly as bleak as you're describing though.
And optimal according to what criteria? Length, safety, sightseeing?
SEEKING WORK / Seattle or remote

About: I manage analytics, dashboarding, data visualization, and data processing products. I conceptualize, design, and manage execution. Keeping my team happy, motivated, and productive while creating delightful user experiences is what excites me; I also enjoy writing code (Ruby and Node.js currently).

Resume: https://crc.io/resume/

Email: hackernews@crc.io
There's no desktop app. There's a CLI, a collection of problems and their respective tests, and a website for some collaborative code review.
Booting Up Alt.Country’s Online Dance
Not even counting the numerous cases of white spaces[1], combining characters, non-breaking space, figure space, soft hyphens or zero-width joiners.
This sounds difficult enough in latin script, almost impossible to capture all cases in non LTR, non-latin grapheme based texts.

[1] http://en.wikipedia.org/wiki/Whitespace_character
Spire Global | San Francisco / Glasgow | VISA OK

Spacecraft Hardware Engineer;
Spacecraft Software Engineer

www.spire.com

Linux, C, Python, embedded systems, RTOS, microcontrollers, etc.

Spire builds and launches small satellites (cubesats) to capture valuable data which we then offer to companies (AIS tracking, weather/climate, etc.). We’re expanding across the globe and will have 20 cubesats in orbit by the end of 2015.

We are a fast moving, energetic start-up applying agile development principles to a traditionally sluggish and overly-burdened industry (and having fun doing it).

You will never be bored at Spire!

Please email Darin@spire.com if you are interested in learning more. Previous work in satellites not required.